Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

My Computer is infected [Solved]

Started by sandybgood , Oct 02 2020 12:35 AM
Virus Slowdown Screen Stuck

  • This topic is locked This topic is locked

#16
sandybgood
Posted 12 October 2020 - 09:30 AM

sandybgood

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts

Here is the Fixlist Log Fix result of Farbar Recovery Scan Tool (x64) Version: 11-10-2020 Ran by SandeepandJaya (12-10-2020 19:35:44) Run:1 Running from C:\Users\SandeepandJaya\Desktop Loaded Profiles: SandeepandJaya Boot Mode: Normal ============================================== fixlist content: ***************** VirusTotal: C:\WINDOWS\system32\CNMN6PPM.DLL;C:\Users\SandeepandJaya\Downloads\5476309_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\3341385.mp4.mp4;C:\Users\SandeepandJaya\Downloads\2085011.mp4.mp4;C:\Users\SandeepandJaya\Downloads\1072439.mp4.mp4;C:\Users\SandeepandJaya\Downloads\473795.mp4.mp4;C:\Users\SandeepandJaya\Downloads\7709035_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\3233347.mp4.mp4;C:\Users\SandeepandJaya\Downloads\5633761_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\244690_hq.mp4.mp4;;C:\Users\SandeepandJaya\Downloads\1211447_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\200363.mp4.mp4;C:\Users\SandeepandJaya\Downloads\1283217_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\1611427_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\280457.mp4.mp4;C:\Users\SandeepandJaya\Downloads\1957199.mp4.mp4;C:\Users\SandeepandJaya\Downloads\109851_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\1603525_hq.mp4 (1).mp4;C:\Users\SandeepandJaya\Downloads\1603525_hq.mp4.mp4 BootExecute: autocheck autochk * sdnclean64.exe FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION FF Extension: (Avast SafePrice | Comparison, deals, coupons) - C:\Users\SandeepandJaya\AppData\Roaming\Mozilla\Firefox\Profiles\3o9gu5wu.default\Extensions\[email protected] [2019-05-22] FF Extension: (Avast Online Security) - C:\Users\SandeepandJaya\AppData\Roaming\Mozilla\Firefox\Profiles\3o9gu5wu.default\Extensions\[email protected] [2019-05-22] S3 McSecDashboardService; C:\Program Files\McAfeeDashboard\McSecDashboardService.exe [1270536 2019-02-26] (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\McAfeeDashboard\McSecDashboardService.exe 2020-10-04 10:34 - 2020-03-25 16:44 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2020-10-04 10:34 - 2019-05-22 15:06 - 000000000 ____D C:\Users\SandeepandJaya\AppData\Local\AVAST Software 2020-10-04 10:34 - 2019-05-22 15:03 - 000000000 ____D C:\ProgramData\AVAST Software 2020-10-04 10:17 - 2020-03-25 16:44 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File FirewallRules: [TCP Query User{B3CA2972-72E2-4725-86D8-D26354473E5E}C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe] => (Allow) C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe => No File FirewallRules: [UDP Query User{53D6A307-AC23-41C2-BF6D-41C3CACD824E}C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe] => (Allow) C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe => No File EmptyTemp: cmd: ipconfig /flushdns ***************** VirusTotal: C:\WINDOWS\system32\CNMN6PPM.DLL => https://www.virustot...3775-1597529833 VirusTotal: C:\Users\SandeepandJaya\Downloads\5476309_hq.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\3341385.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\2085011.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\1072439.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\473795.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\7709035_hq.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\3233347.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\5633761_hq.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\244690_hq.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\1211447_hq.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\200363.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\1283217_hq.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\1611427_hq.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\280457.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\1957199.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\109851_hq.mp4.mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\1603525_hq.mp4 (1).mp4 => (3) Error VirusTotal: C:\Users\SandeepandJaya\Downloads\1603525_hq.mp4.mp4 => (3) Error HKLM\System\CurrentControlSet\Control\Session Manager\\"BootExecute"="autocheck autochk *" => value restored successfully HKLM\SOFTWARE\Policies\Mozilla => removed successfully HKLM\SOFTWARE\Policies\Google => removed successfully C:\Users\SandeepandJaya\AppData\Roaming\Mozilla\Firefox\Profiles\3o9gu5wu.default\Extensions\[email protected] => moved successfully C:\Users\SandeepandJaya\AppData\Roaming\Mozilla\Firefox\Profiles\3o9gu5wu.default\Extensions\[email protected] => moved successfully HKLM\System\CurrentControlSet\Services\McSecDashboardService => removed successfully McSecDashboardService => service removed successfully C:\Program Files\McAfeeDashboard\McSecDashboardService.exe => moved successfully C:\Program Files (x86)\Spybot - Search & Destroy 2 => moved successfully C:\Users\SandeepandJaya\AppData\Local\AVAST Software => moved successfully C:\ProgramData\AVAST Software => moved successfully C:\ProgramData\Spybot - Search & Destroy => moved successfully HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{B3CA2972-72E2-4725-86D8-D26354473E5E}C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe" => removed successfully "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{53D6A307-AC23-41C2-BF6D-41C3CACD824E}C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe" => removed successfully ========= ipconfig /flushdns ========= Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========= End of CMD: ========= =========== EmptyTemp: ========== BITS transfer queue => 10772480 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 7478923 B Java, Flash, Steam htmlcache => 0 B Windows/system/drivers => 3284953 B Edge => 570223 B Chrome => 171281076 B Firefox => 57338600 B Opera => 157775 B Temp, IE cache, history, cookies, recent: Default => 6656 B Users => 6656 B ProgramData => 6656 B Public => 6656 B systemprofile => 6656 B systemprofile32 => 6656 B LocalService => 10420 B NetworkService => 21683454 B SandeepandJaya => 114838486 B RecycleBin => 0 B EmptyTemp: => 369.5 MB temporary data Removed. ================================ The system needed a reboot. ==== End of Fixlog 19:49:38 ====


Edited by sandybgood, 14 October 2020 - 10:02 AM.

  • 0

Advertisements

#17
sandybgood
Posted 12 October 2020 - 09:35 AM

sandybgood

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts

Yes I have set these in Chrome and Edge

CHR StartupUrls: Default -> "hxxps://economictimes.indiatimes.com/"
Edge Notifications: HKU\S-1-5-21-1730742525-4092960748-1108651602-1001 -> hxxps://my.shaadi.com


  • 0

#18
sandybgood
Posted 12 October 2020 - 09:39 AM

sandybgood

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts

I have removed all Chrome Extensions except Chrome Docs, Sheets and Slides . Is this ok ?


  • 0

#19
Gary R
Posted 12 October 2020 - 03:15 PM

Gary R

    Trusted Helper

  • Malware Removal
  • 445 posts

Looks like you've got wordwrap enabled in Notepad, which is why your fixlog looks the way it does.

 

In its current form it's unreadable, so please open Notepad and then click Format and uncheck Wordwrap.

 

Once you've done that, go to C:/FRST/Logs and scroll down to the Fixlog file you have just created, which will have a title something like ... Fixlog_12-10-2020 19:35:44

 

Open this file, and post me the content.

 

I also need you to run the Search that I asked for in post #12 ... http://www.geekstogo...d/#entry2653558


  • 0

#20
sandybgood
Posted 13 October 2020 - 07:20 AM

sandybgood

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts

Hello Gary, Here is the Fixlog file..

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 11-10-2020
Ran by SandeepandJaya (12-10-2020 19:35:44) Run:1
Running from C:\Users\SandeepandJaya\Desktop
Loaded Profiles: SandeepandJaya
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
VirusTotal: C:\WINDOWS\system32\CNMN6PPM.DLL;C:\Users\SandeepandJaya\Downloads\5476309_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\3341385.mp4.mp4;C:\Users\SandeepandJaya\Downloads\2085011.mp4.mp4;C:\Users\SandeepandJaya\Downloads\1072439.mp4.mp4;C:\Users\SandeepandJaya\Downloads\473795.mp4.mp4;C:\Users\SandeepandJaya\Downloads\7709035_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\3233347.mp4.mp4;C:\Users\SandeepandJaya\Downloads\5633761_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\244690_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\1211447_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\200363.mp4.mp4;C:\Users\SandeepandJaya\Downloads\1283217_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\1611427_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\280457.mp4.mp4;C:\Users\SandeepandJaya\Downloads\1957199.mp4.mp4;C:\Users\SandeepandJaya\Downloads\109851_hq.mp4.mp4;C:\Users\SandeepandJaya\Downloads\1603525_hq.mp4 (1).mp4;C:\Users\SandeepandJaya\Downloads\1603525_hq.mp4.mp4
BootExecute: autocheck autochk * sdnclean64.exe
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
FF Extension: (Avast SafePrice | Comparison, deals, coupons) - C:\Users\SandeepandJaya\AppData\Roaming\Mozilla\Firefox\Profiles\3o9gu5wu.default\Extensions\[email protected] [2019-05-22]
FF Extension: (Avast Online Security) - C:\Users\SandeepandJaya\AppData\Roaming\Mozilla\Firefox\Profiles\3o9gu5wu.default\Extensions\[email protected] [2019-05-22]
S3 McSecDashboardService; C:\Program Files\McAfeeDashboard\McSecDashboardService.exe [1270536 2019-02-26] (McAfee, Inc. -> McAfee, Inc.)
C:\Program Files\McAfeeDashboard\McSecDashboardService.exe
2020-10-04 10:34 - 2020-03-25 16:44 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2020-10-04 10:34 - 2019-05-22 15:06 - 000000000 ____D C:\Users\SandeepandJaya\AppData\Local\AVAST Software
2020-10-04 10:34 - 2019-05-22 15:03 - 000000000 ____D C:\ProgramData\AVAST Software
2020-10-04 10:17 - 2020-03-25 16:44 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
FirewallRules: [TCP Query User{B3CA2972-72E2-4725-86D8-D26354473E5E}C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe] => (Allow) C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe => No File
FirewallRules: [UDP Query User{53D6A307-AC23-41C2-BF6D-41C3CACD824E}C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe] => (Allow) C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe => No File
EmptyTemp:
cmd: ipconfig /flushdns
*****************
 
VirusTotal: C:\WINDOWS\system32\CNMN6PPM.DLL => https://www.virustot...3775-1597529833
VirusTotal: C:\Users\SandeepandJaya\Downloads\5476309_hq.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\3341385.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\2085011.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\1072439.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\473795.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\7709035_hq.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\3233347.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\5633761_hq.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\244690_hq.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\1211447_hq.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\200363.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\1283217_hq.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\1611427_hq.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\280457.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\1957199.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\109851_hq.mp4.mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\1603525_hq.mp4 (1).mp4 => (3) Error
VirusTotal: C:\Users\SandeepandJaya\Downloads\1603525_hq.mp4.mp4 => (3) Error
HKLM\System\CurrentControlSet\Control\Session Manager\\"BootExecute"="autocheck autochk *" => value restored successfully
HKLM\SOFTWARE\Policies\Mozilla => removed successfully
HKLM\SOFTWARE\Policies\Google => removed successfully
C:\Users\SandeepandJaya\AppData\Roaming\Mozilla\Firefox\Profiles\3o9gu5wu.default\Extensions\[email protected] => moved successfully
C:\Users\SandeepandJaya\AppData\Roaming\Mozilla\Firefox\Profiles\3o9gu5wu.default\Extensions\[email protected] => moved successfully
HKLM\System\CurrentControlSet\Services\McSecDashboardService => removed successfully
McSecDashboardService => service removed successfully
C:\Program Files\McAfeeDashboard\McSecDashboardService.exe => moved successfully
C:\Program Files (x86)\Spybot - Search & Destroy 2 => moved successfully
C:\Users\SandeepandJaya\AppData\Local\AVAST Software => moved successfully
C:\ProgramData\AVAST Software => moved successfully
C:\ProgramData\Spybot - Search & Destroy => moved successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{B3CA2972-72E2-4725-86D8-D26354473E5E}C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{53D6A307-AC23-41C2-BF6D-41C3CACD824E}C:\users\sandeepandjaya\appdata\roaming\bittorrent\bittorrent.exe" => removed successfully
 
========= ipconfig /flushdns =========
 
 
Windows IP Configuration
 
Successfully flushed the DNS Resolver Cache.
 
========= End of CMD: =========
 
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 10772480 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 7478923 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 3284953 B
Edge => 570223 B
Chrome => 171281076 B
Firefox => 57338600 B
Opera => 157775 B
 
Temp, IE cache, history, cookies, recent:
Default => 6656 B
Users => 6656 B
ProgramData => 6656 B
Public => 6656 B
systemprofile => 6656 B
systemprofile32 => 6656 B
LocalService => 10420 B
NetworkService => 21683454 B
SandeepandJaya => 114838486 B
 
RecycleBin => 0 B
EmptyTemp: => 369.5 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 19:49:38 ====

  • 0

#21
sandybgood
Posted 13 October 2020 - 07:25 AM

sandybgood

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts

Also, here is the log after running the Search All option in FRST...

 

Farbar Recovery Scan Tool (x64) Version: 11-10-2020
Ran by SandeepandJaya (12-10-2020 21:17:35)
Running from C:\Users\SandeepandJaya\Desktop
Boot Mode: Normal
 
================== Search Files: "SearchAll: Avast" =============
 
File:
========
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5.cat
[2020-02-25 19:49][2020-06-21 20:10] 000007456 _____ () DE67AC8142C10EB12E8AE6C6CDBAF799 [File is digitally signed]
 
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5.manifest
[2020-02-25 19:49][2020-02-25 19:49] 000024123 ____N () 47437B704B6D56328C347347462CD02D [File not signed]
 
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128.cat
[2020-02-25 19:49][2020-06-21 20:10] 000007457 _____ () 2A9DFB92BD6DECA69672261DFB9E044D [File is digitally signed]
 
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128.manifest
[2020-02-25 19:49][2020-02-25 19:49] 000001231 ____N () A77C3C57546E0E66394A1DD29129052B [File not signed]
 
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5158632ac9d8192f.cat
[2020-02-25 19:50][2020-06-21 20:10] 000007456 _____ () EAC8D7698558B21A1A533C6A567C06BD [File is digitally signed]
 
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5158632ac9d8192f.manifest
[2020-02-25 19:50][2020-02-25 19:50] 000000754 ____N () F6ED6E08D09EBE10597CB2966F6C394E [File not signed]
 
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_5638651cc6ac4862.cat
[2020-02-25 19:50][2020-06-21 20:10] 000007457 _____ () 777DD2D0BC92B002B9236B6F4F61CB05 [File is digitally signed]
 
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_5638651cc6ac4862.manifest
[2020-02-25 19:50][2020-02-25 19:50] 000000754 ____N () 44D5DDB1B2C027176887E75382F29D55 [File not signed]
 
C:\Windows\WinSxS\Manifests\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb.cat
[2020-02-25 19:49][2020-06-21 20:09] 000007457 _____ () F7BAEFE116151719499F97B4D7A29BC5 [File is digitally signed]
 
C:\Windows\WinSxS\Manifests\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb.manifest
[2020-02-25 19:49][2020-02-25 19:49] 000023610 ____N () FF9B36754303E435AFFABAB5168718B4 [File not signed]
 
C:\Windows\WinSxS\Manifests\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e.cat
[2020-02-25 19:49][2020-06-21 20:10] 000007457 _____ () B021FBE34930277301DEEC14CDD9E3FE [File is digitally signed]
 
C:\Windows\WinSxS\Manifests\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e.manifest
[2020-02-25 19:49][2020-02-25 19:49] 000001227 ____N () 955669576F50AF3D88281103865D3A1D [File not signed]
 
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_99059a01de544235.cat
[2020-02-25 19:49][2020-06-21 20:10] 000007457 _____ () F8999365A25BB341C55C70CB32DF2D46 [File is digitally signed]
 
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_99059a01de544235.manifest
[2020-02-25 19:49][2020-02-25 19:49] 000000750 ____N () 709C8063694781F6371E817243F0EB0F [File not signed]
 
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_9de59bf3db287168.cat
[2020-02-25 19:50][2020-06-21 20:10] 000007456 _____ () DFB0071CF316CD33F04392304A02A289 [File is digitally signed]
 
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_9de59bf3db287168.manifest
[2020-02-25 19:50][2020-02-25 19:50] 000000750 ____N () 8D1CB478D2A7A6AFAE2C38C6524EDA4B [File not signed]
 
C:\Windows\System32\Tasks_Migrated\Avast Emergency Update
[2019-05-22 15:05][2019-09-27 22:40] 000004264 _____ () ED744C717B4B37A84633673626278A79 [File not signed]
 
C:\Windows\Prefetch\AVASTUI.EXE-19622E35.pf
[2020-03-14 11:20][2020-03-14 11:20] 000005901 _____ () DB06EE85BC4091AD413978E195D71DD0 [File not signed]
 
C:\Users\SandeepandJaya\Desktop\Old Firefox Data\9g8e18yf.default-release\extensions\[email protected]
[2020-08-15 23:25][2020-07-14 21:45] 003354753 _____ () 205ACB617315DE756ACBB8F23964B5B5 [File not signed]
 
C:\Users\SandeepandJaya\Desktop\Old Firefox Data\9g8e18yf.default-release\extensions\[email protected]
[2020-08-15 23:25][2020-07-14 21:45] 000590368 _____ () 6DCA1D7EF5ACEEB6A42F04F49D060279 [File not signed]
 
C:\ProgramData\Intel\ShaderCache\AvastUI_0
[2020-09-06 15:12][2020-09-06 15:12] 000000000 _____ () D41D8CD98F00B204E9800998ECF8427E [File not signed]
 
C:\ProgramData\Intel\ShaderCache\AvastUI_1
[2020-09-06 15:12][2020-09-06 15:12] 000000000 _____ () D41D8CD98F00B204E9800998ECF8427E [File not signed]
 
C:\ProgramData\Intel\ShaderCache\AvastUI_2
[2020-09-06 15:12][2020-09-06 15:12] 000000000 _____ () D41D8CD98F00B204E9800998ECF8427E [File not signed]
 
C:\Program Files\WindowsApps\Microsoft.Office.Desktop_16051.13231.20262.0_x86__8wekyb3d8bbwe\Office16\1060\DataServices\+NovaPovezavaStrežnikaSQL.odc
[2018-07-29 00:04][2018-07-29 00:05] 000000196 _____ () 149E8C684B9EA9887DD2E7E596E7187C [File not signed]
 
C:\FRST\Quarantine\C\Users\SandeepandJaya\AppData\Roaming\Mozilla\Firefox\Profiles\3o9gu5wu.default\Extensions\[email protected]
[2020-03-07 14:18][2019-05-22 15:04] 003331183 _____ () F5F36E64AD942C97274FBDC5EE02076D [File not signed]
 
C:\FRST\Quarantine\C\Users\SandeepandJaya\AppData\Roaming\Mozilla\Firefox\Profiles\3o9gu5wu.default\Extensions\[email protected]
[2020-03-07 14:18][2019-05-22 15:04] 000789048 _____ () 72F7EBB68166E86CBDB80B0528464938 [File not signed]
 
C:\FRST\Quarantine\C\ProgramData\AVAST Software\Subscriptions\license.avastlic
[2019-05-22 15:05][2020-10-02 23:30] 000001624 _____ () 202A0EC74C0918363B218D92698004C2 [File not signed]
 
 
folder:
========
2020-02-25 19:49 - 2020-02-25 19:49 _____ C:\Windows\WinSxS\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5
2020-02-25 19:49 - 2020-02-25 19:49 _____ C:\Windows\WinSxS\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128
2020-02-25 19:49 - 2020-02-25 19:49 _____ C:\Windows\WinSxS\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb
2020-02-25 19:49 - 2020-02-25 19:49 _____ C:\Windows\WinSxS\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e
2019-05-22 15:05 - 2019-09-29 20:06 _____ C:\Windows\System32\Tasks_Migrated\Avast Software
2019-05-22 15:06 - 2020-10-04 10:34 _____ C:\FRST\Quarantine\C\Users\SandeepandJaya\AppData\Local\AVAST Software
2019-05-22 15:03 - 2020-10-04 10:34 _____ C:\FRST\Quarantine\C\ProgramData\AVAST Software
2019-05-22 15:03 - 2020-10-04 10:34 _____ C:\FRST\Quarantine\C\ProgramData\AVAST Software\Persistent Data\Avast
 
Registry:
========
[HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software]
[HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software\Browser\aswSP]
"LimitedRegistry"="\REGISTRY\USER\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\AVAST Software\Browser
\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Browser"
[HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software\Browser\aswSP]
"LimitedFolders"="\??\C:\Program Files (x86)\AVAST Software\Browser\
\??\C:\Users\SandeepandJaya\AppData\Local\AVAST Software\Browser\
\??\C:\ProgramData\AVAST Software\Browser\"
[HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software\OPM\data]
"avast"="0x65794A7764584E666247467A644639325A584266646A45694F6E736964476C745A5349364D5455354F544D344E544D344D697769646D4673496A6F794D483073496E42316331397359584E3058335A6C633139324D53493665794A306157316C496A6F784E546B354D7A67314D7A67794C434A32595777694F6A643966513D3D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avast]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}]
"DISPLAYNAME"="Avast Antivirus"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}]
"PRODUCTEXE"="C:\Program Files\AVAST Software\Avast\wsc_proxy.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}]
"REPORTINGEXE"="C:\Program Files\AVAST Software\Avast\wsc_proxy.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AvastSvc_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AvastSvc_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]
"AvastUI.exe"="0x020000000000000000000000"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_5ca6eb17137337f1"="0x41766173742E56433134302E4352542C2043756C747572653D6E65757472616C2C20547970653D77696E33322C2056657273696F6E3D31342E302E32373031322E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D616D643634"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_6186ed0910476724"="0x41766173742E56433134302E4D46432C2043756C747572653D6E65757472616C2C20547970653D77696E33322C2056657273696F6E3D31342E302E32373031322E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D616D643634"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_4f95660acc611f2b"="0x506F6C6963792E31342E302E41766173742E56433134302E4352542C2043756C747572653D6E65757472616C2C20547970653D77696E33322D706F6C6963792C2056657273696F6E3D31342E302E32373031322E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D616D643634"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_547567fcc9354e5e"="0x506F6C6963792E31342E302E41766173742E56433134302E4D46432C2043756C747572653D6E65757472616C2C20547970653D77696E33322D706F6C6963792C2056657273696F6E3D31342E302E32373031322E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D616D643634"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_a45421ee27ef60f7"="0x41766173742E56433134302E4352542C2043756C747572653D6E65757472616C2C20547970653D77696E33322C2056657273696F6E3D31342E302E32373031322E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D783836"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_a93423e024c3902a"="0x41766173742E56433134302E4D46432C2043756C747572653D6E65757472616C2C20547970653D77696E33322C2056657273696F6E3D31342E302E32373031322E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D783836"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_97429ce1e0dd4831"="0x506F6C6963792E31342E302E41766173742E56433134302E4352542C2043756C747572653D6E65757472616C2C20547970653D77696E33322D706F6C6963792C2056657273696F6E3D31342E302E32373031322E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D783836"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_9c229ed3ddb17764"="0x506F6C6963792E31342E302E41766173742E56433134302E4D46432C2043756C747572653D6E65757472616C2C20547970653D77696E33322D706F6C6963792C2056657273696F6E3D31342E302E32373031322E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D783836"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb"="0x41766173742E56433134302E4352542C2043756C747572653D6E65757472616C2C20547970653D77696E33322C2056657273696F6E3D31342E302E32383132372E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D783836"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5"="0x41766173742E56433134302E4352542C2043756C747572653D6E65757472616C2C20547970653D77696E33322C2056657273696F6E3D31342E302E32383132372E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D616D643634"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e"="0x41766173742E56433134302E4D46432C2043756C747572653D6E65757472616C2C20547970653D77696E33322C2056657273696F6E3D31342E302E32383132372E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D783836"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128"="0x41766173742E56433134302E4D46432C2043756C747572653D6E65757472616C2C20547970653D77696E33322C2056657273696F6E3D31342E302E32383132372E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D616D643634"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_99059a01de544235"="0x506F6C6963792E31342E302E41766173742E56433134302E4352542C2043756C747572653D6E65757472616C2C20547970653D77696E33322D706F6C6963792C2056657273696F6E3D31342E302E32383132372E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D783836"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5158632ac9d8192f"="0x506F6C6963792E31342E302E41766173742E56433134302E4352542C2043756C747572653D6E65757472616C2C20547970653D77696E33322D706F6C6963792C2056657273696F6E3D31342E302E32383132372E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D616D643634"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_9de59bf3db287168"="0x506F6C6963792E31342E302E41766173742E56433134302E4D46432C2043756C747572653D6E65757472616C2C20547970653D77696E33322D706F6C6963792C2056657273696F6E3D31342E302E32383132372E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D783836"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\IsolatedSxSAssemblies]
"amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_5638651cc6ac4862"="0x506F6C6963792E31342E302E41766173742E56433134302E4D46432C2043756C747572653D6E65757472616C2C20547970653D77696E33322D706F6C6963792C2056657273696F6E3D31342E302E32383132372E302C205075626C69634B6579546F6B656E3D666363393965653631393365626263612C2050726F636573736F724172636869746563747572653D616D643634"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_avast.vc140.crt_fcc99ee6193ebbca_none_020285fe6d6e0580]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_avast.vc140.mfc_fcc99ee6193ebbca_none_018be6966dc83925]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_none_ef17e13d91c55d96]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_none_eea141d5921f913b]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_avast.vc140.crt_fcc99ee6193ebbca_none_49afbcd581ea2e86]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_avast.vc140.mfc_fcc99ee6193ebbca_none_49391d6d8244622b]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_none_36c51814a641869c]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_none_364e78aca69bba41]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Performance Toolkit\v5\WPR\WprApp]
"RecordingTempDir"="C:\ProgramData\AVAST Software\Avast\log\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsSelfHost\OneSettings]
"TargetingAttributes"="{
  "Version": 108,
  "SchemaVersion": 1,
  "PartA": [
    "App",
    "AppVer",
    "AttrDataVer"
  ],
  "Default": [
    "DeviceFamily",
    "f:FlightRing",
    "t:OSVersionFull"
  ],
  "PartB": {
    "ACSOVERRIDE": [
      "OSArchitecture",
      "c:IsAlwaysOnAlwaysConnectedCapable"
    ],
    "CASSCLIENT": [
      "OSVersion",
      "c:OSEdition",
      "f:FlightRing"
    ],
    "CDM": [
      "ChassisTypeId",
      "r:CurrentBranch",
      "DeviceFamily",
      "f:FlightingBranchName",
      "f:FlightRing",
      "c:InstallLanguage",
      "c:IsDomainJoined",
      "t:IsTestLab",
      "OEMModel",
      "OSArchitecture",
      "OSVersion",
      "t:OSSkuId",
      "c:ProcessorIdentifier",
      "c:TelemetryLevel",
      "t:IsMsftOwned",
      "t:WCOSProductId",
      "c:OSUILocale",
      "c:CommercialId",
      "s:MinShellVersion",
      "s:MaxShellVersion",
      "c:ActivationChannel",
      "c:SCCMClientId",
      "c:IsCloudDomainJoined"
    ],
    "COMPATLOGGER": [
      "osVer",
      "ring",
      "deviceId"
    ],
    "CORTANA_GATEKEEPER": [
      "r:CurrentBranch",
      "f:FlightRing",
      "f:IsRetailOS"
    ],
    "CORTANAUWP": [
      "c:OSUILocale",
      "t:OSVersionFull",
      "v:CortanaAppVer"
    ],
    "CORTANAUWPTEST": [
      "+CORTANAUWP",
      "v:CortanaAppVerTest"
    ],
    "CTAC": [
      "+FSS"
    ],
    "DDC": [
      "+WU_STORE",
      "+_WU_PTI"
    ],
    "DXDB": [
      "DeviceFamily",
      "f:FlightRing",
      "r:IsHybridOrXGpu",
      "t:OSVersionFull"
    ],
    "EDGE_SERVICEUI": [
      "t:LocalDeviceID",
      "t:LocalUserID"
    ],
    "FCON": [
      "+CDM"
    ],
    "FSS": [
      "r:PreviewBuildsManagerEnabled",
      "f:BranchReadinessLevelRaw",
      "u:BranchReadinessLevelSource",
      "r:BuildFID",
      "t:DeviceFamily",
      "DeviceId",
      "c:EnablePreviewBuilds",
      "f:FlightingPolicyValue",
      "f:IsRetailOS",
      "f:ManagePreviewBuilds",
      "OSVersionFull",
      "t:WCOSProductId",
      "r:SmartActiveHoursState",
      "r:ActiveHoursStart",
      "r:ActiveHoursEnd"
    ],
    "FXIRISCLIENT": [
      "+IRISCLIENT"
    ],
    "IRISCLIENT": [
      "DeviceFamily",
      "OSVersion",
      "t:OSSkuId",
      "OSArchitecture",
      "c:TelemetryLevel",
      "f:FlightRing",
      "f:FlightingBranchName",
      "c:InternalPrimaryDisplayResolutionHorizontal",
      "c:InternalPrimaryDisplayResolutionVetical",
      "t:IsMsftOwned",
      "c:ChassisType",
      "c:IsDomainJoined",
      "c:ProcessorIdentifier",
      "c:CommercialId",
      "OEMModel",
      "c:OSUILocale",
      "c:OSEdition",
      "c:FlightIds",
      "t:LocalUserID",
      "r:CurrentBranch",
      "t:WCOSProductId"
    ],
    "MICROSOFT.WINDOWSFEEDBACKHUB_8WEKYB3D8BBWE": [
      "t:OSVersionFull",
      "t:IsTestLab",
      "f:FlightRing"
    ],
    "MITIGATION": [
      "t:DeviceFamily",
      "f:FlightRing",
      "c:FlightIds",
      "c:IsDomainJoined",
      "t:IsMsftOwned",
      "f:IsRetailOS",
      "t:IsTestLab",
      "IsVM",
      "OEMModel",
      "c:OSEdition",
      "t:OSSkuId",
      "t:OSVersionFull",
      "c:OSUILocale",
      "t:SMode",
      "f:IsFlightingEnabled",
      "c:FirmwareVersion",
      "c:TelemetryLevel",
      "f:FlightingBranchName",
      "r:CurrentBranch",
      "OSVersion",
      "w:FirstStorageSpaceDeviceId",
      "r:IsCldFltSyncRoots",
      "c:OSInstallType",
      "v:IsNotepadExePresent"
    ],
    "MLMOD": [
      "ChassisTypeId",
      "t:DeviceFamily",
      "f:FlightingBranchName",
      "f:FlightRing",
      "f:IsRetailOS",
      "t:OSSkuId",
      "t:OSVersionFull",
      "c:OSUILocale",
      "OSVersion",
      "c:TelemetryLevel",
      "r:CurrentBranch",
      "t:IsTestLab"
    ],
    "MTP": [
      "+_WU_OS_CORE"
    ],
    "MUSE": [
      "+_WU_FB",
      "ChassisTypeId",
      "deviceClass",
      "deviceId",
      "c:FlightIds",
      "locale",
      "ms",
      "os",
      "osVer",
      "ring",
      "sampleId",
      "sku",
      "r:DaysSince19H1FUOffer",
      "u:DisableDualScan",
      "u:UpdateServiceUrl",
      "c:CommercialId",
      "f:FlightingBranchName",
      "c:SystemVolumeTotalCapacity",
      "c:IsAlwaysOnAlwaysConnectedCapable",
      "c:ProcessorCores",
      "c:PrimaryDiskType",
      "c:TotalPhysicalRAM",
      "c:ProcessorClockSpeed"
    ],
    "NOISYHAMMER": [
      "+WU_OS"
    ],
    "SEDIMENTPACK": [
      "+WU_OS"
    ],
    "SERVICING_CBS": [
      "+WU"
    ],
    "SETUP360": [
      "t:OSSkuId",
      "f:FlightRing"
    ],
    "STORAGEGROVELER": [
      "a:Free",
      "c:TelemetryLevel",
      "f:FlightRing",
      "f:IsFlightingEnabled",
      "IsVM",
      "t:OSVersionFull"
    ],
    "UTC": [
      "+UTC_STATIC",
      "osVer",
      "locale",
      "ring",
      "f:PilotRing",
      "f:IsRetailOS",
      "ms",
      "expId",
      "t:SMode",
      "f:FlightingBranchName",
      "c:CommercialId",
      "r:IsFeedbackHubSelfhost"
    ],
    "UTC_STATIC": [
      "os",
      "deviceId",
      "sampleId",
      "deviceClass",
      "sku",
      "OEMModel",
      "OEMName_Uncleaned",
      "c:PrimaryDiskType",
      "c:ProcessorModel",
      "c:TotalPhysicalRAM"
    ],
    "UUS": [
      "OSVersion",
      "f:FlightRing",
      "t:IsTestLab",
      "t:OSVersionFull",
      "f:FlightingBranchName",
      "r:CurrentBranch"
    ],
    "WAASASSESSMENT": [
      "+WU_OS"
    ],
    "WAASMEDIC": [
      "os",
      "osVer",
      "ring",
      "deviceClass",
      "deviceId",
      "locale",
      "sku"
    ],
    "WOSC": [
      "t:DeviceFamily",
      "f:FlightRing",
      "f:IsFlightingEnabled",
      "t:IsMsftOwned",
      "t:LocalDeviceID",
      "t:OSSkuId",
      "c:OSUILocale",
      "t:OSVersionFull",
      "c:TelemetryLevel",
      "r:IsHybridOrXGpu",
      "r:PlayFabPartyRelay"
    ],
    "WPSHIFT": [
      "+MTP"
    ],
    "WU": [
      "+WU_OS",
      "r:DUInternal"
    ],
    "_WU_AV": [
      "r:AvastReg",
      "r:AvastBlackScreen",
      "v:AvastVer",
      "r:AvgReg",
      "v:AvgVer",
      "r:EsetReg",
      "v:EsetVer",
      "r:KasperskyReg",
      "v:KasperskyVer",
      "v:SymantecVer",
      "r:TencentReg",
      "r:TencentType",
      "r:AhnlabInstalledKey",
      "r:AvastInstalledKey",
      "r:AVGInstalledKey",
      "r:AviraInstalledKey",
      "r:BullguardInstalledKey",
      "r:ESETInstalledKey",
      "r:ESTSecurityInstalledKey",
      "r:FSecureInstalledKey",
      "v:GDataInstalledVer",
      "r:K7InstalledKey",
      "r:KasperskyInstalledKey",
      "r:KingsoftInstalledKey",
      "r:LenovoInstalledKey",
      "r:MalwarebytesInstalledKey",
      "r:McAfeeInstalledKey",
      "r:PandaInstalledKey",
      "r:QuickhealInstalledKey1",
      "r:SophosInstalledKey1",
      "r:SymantecInstalledKey",
      "r:TencentInstalledKey",
      "r:ThreatTrackInstalledKey",
      "r:TrendInstalledKey",
      "r:WebrootInstalledKey",
      "v:K7InstalledVer"
    ],
    "_WU_COMMON": [
      "r:CurrentBranch",
      "r:DefaultUserRegion",
      "DeviceFamily",
      "r:DriverPartnerRing",
      "r:FlightContent",
      "f:FlightingBranchName",
      "f:FlightRing",
      "HoloLens",
      "c:InstallationType",
      "c:InstallLanguage",
      "f:IsFlightingEnabled",
      "r:IsFlightingEnabled",
      "c:MobileOperatorCommercialized",
      "OEMModel",
      "OEMName_Uncleaned",
      "r:OemPartnerRing",
      "OSArchitecture",
      "OSVersion",
      "t:OSSkuId",
      "c:OSUILocale",
      "c:ProcessorManufacturer",
      "r:ReleaseType",
      "v:SkypeRoomSystem",
      "t:SMode",
      "c:TelemetryLevel",
      "r:WindowsMixedReality",
      "v:WuClientVer",
      "p:DucPublisherId",
      "p:DucDeviceModelId",
      "p:DucOemPartnerRing",
      "p:DucCustomPackageId",
      "p:DesiredOsVersion",
      "p:DesiredSystemManifestVersion"
    ],
    "_WU_FB": [
      "u:BranchReadinessLevel",
      "u:DeferQualityUpdatePeriodInDays",
      "u:DeferFeatureUpdatePeriodInDays",
      "r:PausedFeatureStatus",
      "r:PausedQualityStatus",
      "u:TargetReleaseVersion",
      "r:QUDeadline",
      "r:UpdatePreference",
      "r:UpdateOfferedDays"
    ],
    "WU_OS": [
      "+_WU_OS_CORE",
      "+_WU_FB"
    ],
    "_WU_OS_CORE": [
      "+_WU_COMMON",
      "+_WU_AV",
      "r:AhnLabKeyboard",
      "a:Bios",
      "r:BlockFeatureUpdates",
      "c:CommercialId",
      "a:DataVer_RS5",
      "r:DisconnectedStandby",
      "r:DchuNvidiaGrfxExists",
      "r:DchuNvidiaGrfxVen",
      "r:DchuIntelGrfxExists",
      "r:DchuIntelGrfxVen",
      "r:DchuAmdGrfxExists",
      "r:DchuAmdGrfxVen",
      "c:FirmwareVersion",
      "a:Free",
      "a:GStatus_RS3",
      "a:GStatus_RS4",
      "a:GStatus_RS5",
      "r:HidOverGattReg",
      "r:InstallDate",
      "c:IsDeviceRetailDemo",
      "c:IsPortableOperatingSystem",
      "IsVM",
      "c:OEMModelBaseBoard",
      "r:OobeSeeker",
      "r:OSRollbackBuild",
      "r:OSRollbackCount",
      "r:OSRollbackDate",
      "PhoneTargetingName",
      "r:PonchAllow",
      "r:PonchBlock",
      "c:ProcessorIdentifier",
      "r:RecoveredFromBuild",
      "r:RecoveredOnDate",
      "r:Steam",
      "v:TobiiVer",
      "v:TrendMicroVer",
      "r:UninstallActive",
      "l:UpdateManagementGroup",
      "a:UpgEx_RS3",
      "a:UpgEx_RS4",
      "a:UpgEx_RS5",
      "a:Version_RS5",
      "r:DisableWUfBOfferBlock",
      "a:UpgEx_19H1",
      "a:SdbVer_19H1",
      "a:GStatus_19H1",
      "a:GStatus_19H1Setup",
      "a:TimestampEpochString_19H1Setup",
      "a:GenTelRunTimestamp_19H1",
      "a:DataExpDateEpoch_19H1",
      "u:EnableWUfBUpgradeGates",
      "r:GStatusBlockIDs_All",
      "TimestampDelta_19H1Subtract19H1Setup",
      "DataExpDateDelta_19H1Subtract19H1Setup",
      "a:DataExpDateEpoch_19H1Setup",
      "a:TimestampEpochString_19H1",
      "r:IsContainerMgrInstalled",
      "r:IsWDAGEnabled",
      "r:MTPTargetingInfo",
      "r:EKB19H2InstallCount",
      "r:EKB19H2UnInstallCount",
      "r:EKB19H2InstallTimeEpoch",
      "r:EKB19H2UnInstallTimeEpoch",
      "r:BlockEdgeWithChromiumUpdate",
      "r:IsWDATPEnabled",
      "r:IsAutopilotRegistered",
      "r:EdgeWithChromiumInstallVersion",
      "r:EdgeWithChromiumInstallFailureCount",
      "r:IsEdgeWithChromiumInstalled",
      "r:KioskMode",
      "c:IsCloudDomainJoined",
      "c:IsDomainJoined",
      "p:DSS_Enrolled",
      "a:DataExpDateEpoch_20H1",
      "a:DataExpDateEpoch_20H1Setup",
      "a:GStatus_20H1",
      "a:GStatus_20H1Setup",
      "a:SdbVer_20H1",
      "a:TimestampEpochString_20H1",
      "a:TimestampEpochString_20H1Setup",
      "DataExpDateDelta_20H1Subtract20H1Setup",
      "TimestampDelta_20H1Subtract20H1Setup",
      "a:UpgEx_20H1",
      "r:AutopilotUpdateInProgress",
      "r:UHSEnrolled",
      "r:HotPatchEKBInstalled",
      "r:LCUVer",
      "c:isCommercial",
      "c:ActivationChannel",
      "c:IsMDMEnrolled",
      "c:SCCMClientID"
    ],
    "_WU_PTI": [
      "c:FrontFacingCameraResolution",
      "c:RearFacingCameraResolution",
      "c:TotalPhysicalRAM",
      "c:NFCProximity",
      "c:Magnetometer",
      "c:Gyroscope",
      "c:D3DMaxFeatureLevel",
      "c:InternalPrimaryDisplayResolutionHorizontal",
      "c:InternalPrimaryDisplayResolutionVetical"
    ],
    "WU_STORE": [
      "+_WU_COMMON",
      "r:AppChannels",
      "r:AppRMIDs",
      "u:BranchReadinessLevel"
    ]
  },
  "Required": [
    "App",
    "AppVer",
    "AttrDataVer"
  ],
  "Aliases": {
    "ChassisTypeId": "c:ChassisType",
    "DataExpDateDelta_19H1Subtract19H1Setup": "a:DataExpDateEpoch_19H1_Subtract_DataExpDateEpoch_19H1Setup",
    "DataExpDateDelta_20H1Subtract20H1Setup": "a:DataExpDateEpoch_20H1_Subtract_DataExpDateEpoch_20H1Setup",
    "deviceClass": "t:DeviceFamily",
    "deviceId": "t:LocalDeviceID",
    "DeviceId": "t:LocalDeviceID",
    "expId": "c:FlightIds",
    "FlightRing": "f:FlightRing",
    "IsVM": "a:ISVM",
    "locale": "c:OSUILocale",
    "ms": "t:IsMsftOwned",
    "OEMModel": "c:OEMModelNumber",
    "OEMName_Uncleaned": "c:OEMManufacturerName",
    "osVer": "t:OSVersionFull",
    "OSVersionFull": "t:OSVersionFull",
    "PhoneTargetingName": "c:OEMModelName",
    "ring": "f:FlightRing",
    "sampleId": "t:PopVal",
    "sku": "t:OSSkuId",
    "TimestampDelta_19H1Subtract19H1Setup": "a:TimestampEpochString_19H1_Subtract_TimestampEpochString_19H1Setup",
    "TimestampDelta_20H1Subtract20H1Setup": "a:TimestampEpochString_20H1_Subtract_TimestampEpochString_20H1Setup"
  },
  "Fallback": {
    "r:AhnlabInstalledKey": "r:AhnlabInstalledWowKey",
    "r:AvastBlackScreen": "r:AvgBlackScreen",
    "r:AvastInstalledKey": "r:AvastInstalledWowKey",
    "r:AVGInstalledKey": "r:AVGInstalledWowKey",
    "r:AviraInstalledKey": "r:AviraInstalledWowKey",
    "a:Bios": "a:Bios_RS3",
    "a:Bios_RS3": "a:Bios_RS4",
    "a:Bios_RS4": "a:Bios_RS5",
    "r:BlockFeatureUpdates": "r:BlockWUUpgrades",
    "r:BlockWUUpgrades": "r:BlockWUUpgradesWow",
    "r:BuildFID": "r:BuildFID_WCOS",
    "r:BuildFID_WCOS": "r:BuildFID_WCOS2",
    "r:BullguardInstalledKey": "v:BullguardInstalledVer",
    "r:DchuAmdGrfxVen": "r:DchuAmdGrfxVen2",
    "r:DchuAmdGrfxVen2": "r:DchuAmdGrfxDeletePending",
    "r:DchuIntelGrfxDeletePending": "r:DchuIntelGrfxNExists",
    "r:DchuIntelGrfxVen": "r:DchuIntelGrfxVen2",
    "r:DchuIntelGrfxVen2": "r:DchuIntelGrfxDeletePending",
    "r:DchuNvidiaGrfxVen": "r:DchuNvidiaGrfxVen2",
    "r:DchuNvidiaGrfxVen2": "r:DchuNvidiaGrfxDeletePending",
    "r:DriverPartnerRing": "r:OSDataDriverPartnerRing",
    "p:DSS_Enrolled": "r:DSS_EnrolledReg",
    "r:EdgeWithChromiumInstallFailureCount": "r:EdgeWithChromiumInstallFailureCountWow",
    "r:EdgeWithChromiumInstallVersion": "r:EdgeWithChromiumInstallVersionWow",
    "u:EnableWUfBUpgradeGates": "r:EnableWUfBUpgradeGatesRS5",
    "r:ESETInstalledKey": "r:ESETInstalledWowKey",
    "r:ESTSecurityInstalledKey": "r:ESTSecurityInstalledWowKey",
    "f:FlightingBranchName": "c:FlightingBranchName",
    "a:Free": "a:Free_RS3",
    "a:Free_RS3": "a:Free_RS4",
    "a:Free_RS4": "a:Free_RS5",
    "r:FSecureInstalledKey": "r:FSecureInstalledWowKey",
    "HoloLens": "r:WindowsMixedReality",
    "r:IsEdgeWithChromiumInstalled": "r:IsEdgeWithChromiumInstalledWow",
    "a:ISVM": "a:ISVM_RS3",
    "a:ISVM_RS3": "a:ISVM_RS4",
    "a:ISVM_RS4": "a:ISVM_RS5",
    "r:K7InstalledKey": "r:K7InstalledWowKey",
    "r:KasperskyInstalledKey": "r:KasperskyInstalledWowKey",
    "r:KingsoftInstalledKey": "r:KingsoftInstalledWowKey",
    "r:LenovoInstalledKey": "r:LenovoInstalledWowKey",
    "r:MalwarebytesInstalledKey": "r:MalwarebytesInstalledWowKey",
    "r:McAfeeInstalledKey": "r:McAfeeInstalledWowKey",
    "c:OEMModelBaseBoard": "r:OEMModelBaseBoard",
    "r:PandaInstalledKey": "r:PandaInstalledWowKey",
    "r:PandaInstalledWowKey": "v:PandaInstalledVer",
    "r:PonchAllow": "r:PonchAllowKey",
    "r:PonchAllowKey": "r:PonchAllowWow",
    "r:PonchAllowWow": "r:PonchAllowWowKey",
    "r:QUDeadline": "r:QUDeadlineMDM",
    "r:QuickhealInstalledKey1": "r:QuickhealInstalledKey2",
    "r:SophosInstalledKey1": "r:SophosInstalledKey2",
    "r:SymantecInstalledKey": "r:SymantecInstalledWowKey",
    "v:SymantecVer": "v:SymantecVer64",
    "u:TargetReleaseVersion": "r:TargetReleaseVersionGP",
    "r:TargetReleaseVersionGP": "r:TargetReleaseVersionMDM",
    "r:TencentInstalledKey": "r:TencentInstalledWowKey",
    "r:ThreatTrackInstalledKey": "r:ThreatTrackInstalledWowKey",
    "v:TobiiVer": "v:TobiiVerx86",
    "v:TobiiVerx86": "v:TobiiVer1x86",
    "r:TrendInstalledKey": "r:TrendInstalledWowKey",
    "r:TrendInstalledWowKey": "v:TrendInstalledVer",
    "r:WebrootInstalledKey": "r:WebrootInstalledWowKey"
  },
  "Transform": {
    "IsDomainJoined": {
      "Ignore": [
        "0"
      ]
    },
    "IsHybridOrXGpu": {
      "Ignore": [
        "0"
      ]
    },
    "IsMsftOwned": {
      "Ignore": [
        "0"
      ]
    },
    "IsPortableOperatingSystem": {
      "Ignore": [
        "0"
      ]
    },
    "IsTestLab": {
      "Ignore": [
        "0"
      ]
    },
    "IsVM": {
      "Ignore": [
        "0"
      ]
    },
    "OEMModel": {
      "SubLength": 100
    },
    "OEMName_Uncleaned": {
      "SubLength": 100
    },
    "PausedFeatureStatus": {
      "Ignore": [
        "0"
      ]
    },
    "PausedQualityStatus": {
      "Ignore": [
        "0"
      ]
    },
    "SMode": {
      "Ignore": [
        "0"
      ]
    }
  },
  "Registry": {
    "ActiveHoursEnd": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings",
      "ValueName": "ActiveHoursEnd",
      "RegValueType": "REG_DWORD"
    },
    "ActiveHoursStart": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings",
      "ValueName": "ActiveHoursStart",
      "RegValueType": "REG_DWORD"
    },
    "AhnlabInstalledKey": {
      "FullPath": "SOFTWARE\\Ahnlab",
      "IfExists": true
    },
    "AhnlabInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Ahnlab",
      "IfExists": true
    },
    "AhnLabKeyboard": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\Mkd2kfNt",
      "ValueName": "NbTpMsExist"
    },
    "AppChannels": {
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\WindowsStore\\Apps\\*",
      "ValueName": "ChannelId",
      "EncodingType": "Json"
    },
    "AppRMIDs": {
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\WindowsStore\\Apps\\*",
      "ValueName": "ReleaseManagementId",
      "EncodingType": "Json"
    },
    "AutopilotUpdateInProgress": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Provisioning\\AutopilotSettings\\VolatileAutopilotUpdate",
      "ValueName": "AutopilotUpdateInProgress",
      "RegValueType": "REG_DWORD"
    },
    "AvastBlackScreen": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\aswVmm\\Parameters",
      "ValueName": "Win10-1803"
    },
    "AvastInstalledKey": {
      "FullPath": "SOFTWARE\\Avast Software\\Avast",
      "IfExists": true
    },
    "AvastInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Avast Software\\Avast",
      "IfExists": true
    },
    "AvastReg": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\aswVmm\\Parameters",
      "ValueName": "QualityCompat"
    },
    "AvgBlackScreen": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\avgVmm\\Parameters",
      "ValueName": "Win10-1803"
    },
    "AVGInstalledKey": {
      "FullPath": "SOFTWARE\\AVG\\Antivirus",
      "IfExists": true
    },
    "AVGInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\AVG\\Antivirus",
      "IfExists": true
    },
    "AvgReg": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\avgVmm\\Parameters",
      "ValueName": "QualityCompat"
    },
    "AviraInstalledKey": {
      "FullPath": "SOFTWARE\\X-AVCSD\\Workstation\\Antivirus",
      "IfExists": true
    },
    "AviraInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\X-AVCSD\\Workstation\\Antivirus",
      "IfExists": true
    },
    "BlockEdgeWithChromiumUpdate": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\EdgeUpdate",
      "ValueName": "DoNotUpdateToEdgeWithChromium",
      "RegValueType": "REG_DWORD"
    },
    "BlockFeatureUpdates": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade",
      "ValueName": "BlockFeatureUpdates",
      "RegValueType": "REG_DWORD"
    },
    "BlockWUUpgrades": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows10Upgrader\\Volatile",
      "ValueName": "BlockWUUpgrades",
      "RegValueType": "REG_DWORD"
    },
    "BlockWUUpgradesWow": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows10Upgrader\\Volatile",
      "ValueName": "BlockWUUpgrades",
      "RegValueType": "REG_DWORD"
    },
    "BuildFID": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "Software\\Microsoft\\Windows\\CurrentVersion\\Flighting\\Build",
      "ValueName": "EsdFlightData",
      "RegValueType": "REG_SZ"
    },
    "BuildFID_WCOS": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "OSDATA\\Software\\Microsoft\\Windows\\CurrentVersion\\Flighting\\Build",
      "ValueName": "EsdFlightData",
      "RegValueType": "REG_SZ"
    },
    "BuildFID_WCOS2": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "OSDATA\\Microsoft\\Windows\\CurrentVersion\\Flighting\\Build",
      "ValueName": "EsdFlightData",
      "RegValueType": "REG_SZ"
    },
    "BullguardInstalledKey": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\BullGuard",
      "IfExists": true
    },
    "CurrentBranch": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
      "ValueName": "BuildBranch",
      "RegValueType": "REG_SZ"
    },
    "DaysSince19H1FUOffer": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\rempl\\irplugin",
      "ValueName": "DaysSinceLastOffer",
      "RegValueType": "REG_QWORD"
    },
    "DchuAmdGrfxDeletePending": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\amdkmdag",
      "ValueName": "DriverDelete"
    },
    "DchuAmdGrfxExists": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\amdkmdag",
      "IfExists": true
    },
    "DchuAmdGrfxVen": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\amdkmdag",
      "ValueName": "DCHUVen"
    },
    "DchuAmdGrfxVen2": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\amdkmdag\\Parameters",
      "ValueName": "DCHUVen"
    },
    "DchuIntelGrfxDeletePending": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\igfx",
      "ValueName": "DriverDelete"
    },
    "DchuIntelGrfxExists": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\igfx",
      "IfExists": true
    },
    "DchuIntelGrfxNExists": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\igfxn",
      "IfExists": true
    },
    "DchuIntelGrfxVen": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\igfx",
      "ValueName": "DCHUVen"
    },
    "DchuIntelGrfxVen2": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\igfx\\Parameters",
      "ValueName": "DCHUVen"
    },
    "DchuNvidiaGrfxDeletePending": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\nvlddmkm",
      "ValueName": "DriverDelete"
    },
    "DchuNvidiaGrfxExists": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\nvlddmkm",
      "IfExists": true
    },
    "DchuNvidiaGrfxVen": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\nvlddmkm",
      "ValueName": "DCHUVen"
    },
    "DchuNvidiaGrfxVen2": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\nvlddmkm\\Parameters",
      "ValueName": "DCHUVen"
    },
    "DefaultUserRegion": {
      "HKey": "HKEY_USERS",
      "FullPath": ".DEFAULT\\Control Panel\\International\\Geo",
      "ValueName": "Nation",
      "RegValueType": "REG_SZ"
    },
    "DisableWUfBOfferBlock": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UpdatePolicy\\Settings",
      "ValueName": "DisableWUfBOfferBlock",
      "RegValueType": "REG_DWORD"
    },
    "DisconnectedStandby": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\CurrentControlSet\\Control\\Power",
      "ValueName": "EnforceDisconnectedStandby",
      "RegValueType": "REG_DWORD"
    },
    "DriverPartnerRing": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\DriverFlighting\\Partner",
      "ValueName": "TargetRing",
      "RegValueType": "REG_SZ"
    },
    "DSS_EnrolledReg": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
      "ValueName": "EnableWUfBCloud",
      "RegValueType": "REG_DWORD"
    },
    "DUInternal": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Setup\\MoSetup",
      "ValueName": "DynamicUpdateInternalTest",
      "RegValueType": "REG_DWORD"
    },
    "EdgeWithChromiumInstallFailureCount": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\EdgeUpdate",
      "ValueName": "WindowsUpdateAttempts"
    },
    "EdgeWithChromiumInstallFailureCountWow": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Wow6432Node\\Microsoft\\EdgeUpdate",
      "ValueName": "WindowsUpdateAttempts"
    },
    "EdgeWithChromiumInstallVersion": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\EdgeUpdate",
      "ValueName": "WindowsUpdateVersion"
    },
    "EdgeWithChromiumInstallVersionWow": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Wow6432Node\\Microsoft\\EdgeUpdate",
      "ValueName": "WindowsUpdateVersion"
    },
    "EKB19H2InstallCount": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Setup\\FeatureStaging\\20455539\\2",
      "ValueName": "Count"
    },
    "EKB19H2InstallTimeEpoch": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Setup\\FeatureStaging\\20455539\\2",
      "ValueName": "Timestamp"
    },
    "EKB19H2UnInstallCount": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Setup\\FeatureStaging\\20455539\\0",
      "ValueName": "Count"
    },
    "EKB19H2UnInstallTimeEpoch": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Setup\\FeatureStaging\\20455539\\0",
      "ValueName": "Timestamp"
    },
    "EnableWUfBUpgradeGatesRS5": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "Software\\Microsoft\\Windows NT\\CurrentVersion\\502505fe-762c-4e80-911e-0c3fa4c63fb0",
      "ValueName": "DataRequireGatedScanForFeatureUpdates",
      "RegValueType": "REG_DWORD"
    },
    "ESETInstalledKey": {
      "FullPath": "SOFTWARE\\ESET\\ESET Security",
      "IfExists": true
    },
    "ESETInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\ESET\\ESET Security",
      "IfExists": true
    },
    "EsetReg": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\ehdrv\\Parameters",
      "ValueName": "WindowsCompatibilityLevel",
      "RegValueType": "REG_DWORD"
    },
    "ESTSecurityInstalledKey": {
      "FullPath": "SOFTWARE\\ESTsoft",
      "IfExists": true
    },
    "ESTSecurityInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\ESTsoft",
      "IfExists": true
    },
    "FlightContent": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability",
      "ValueName": "ContentType",
      "RegValueType": "REG_SZ"
    },
    "FSecureInstalledKey": {
      "FullPath": "SOFTWARE\\F-Secure\\OneClient",
      "IfExists": true
    },
    "FSecureInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\F-Secure\\OneClient",
      "IfExists": true
    },
    "GStatusBlockIDs_All": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Appraiser\\GWX",
      "ValueName": "SdbEntries",
      "RegValueType": "REG_SZ"
    },
    "HidOverGattReg": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\PnpLockdownFiles\\%SystemRoot%/System32/drivers/UMDF/Microsoft.Bluetooth.Profiles.HidOverGatt.dll",
      "ValueName": "Source",
      "RegValueType": "REG_SZ"
    },
    "HotPatchEKBInstalled": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hotpatch.amd64",
      "IfExists": true
    },
    "InstallDate": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
      "ValueName": "InstallDate",
      "RegValueType": "REG_DWORD"
    },
    "IsAutopilotRegistered": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Provisioning\\AutopilotPolicyCache",
      "ValueName": "ProfileAvailable",
      "RegValueType": "REG_DWORD"
    },
    "IsFlightingEnabled": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability",
      "ValueName": "IsBuildFlightingEnabled",
      "RegValueType": "REG_DWORD"
    },
    "IsCldFltSyncRoots": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager\\*",
      "IfExists": true
    },
    "IsContainerMgrInstalled": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\CmService",
      "IfExists": true
    },
    "IsEdgeWithChromiumInstalled": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}",
      "IfExists": true
    },
    "IsEdgeWithChromiumInstalledWow": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Wow6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}",
      "IfExists": true
    },
    "IsFeedbackHubSelfhost": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Diagnostics\\DiagTrack\\Partners\\IsFeedbackHubSelfhost",
      "IfExists": true
    },
    "IsHybridOrXGpu": {
      "FullPath": "SOFTWARE\\Microsoft\\DirectX",
      "ValueName": "HybridDeviceApplicableForDxDbGpuPreferences"
    },
    "IsWDAGEnabled": {
      "FullPath": "SYSTEM\\ControlSet001\\Services\\hvsics",
      "IfExists": true
    },
    "IsWDATPEnabled": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows Advanced Threat Protection\\Status",
      "ValueName": "OnboardingState"
    },
    "K7InstalledKey": {
      "FullPath": "SOFTWARE\\K7 Computing",
      "IfExists": true
    },
    "K7InstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\K7 Computing",
      "IfExists": true
    },
    "KasperskyInstalledKey": {
      "FullPath": "SOFTWARE\\KasperskyLab",
      "IfExists": true
    },
    "KasperskyInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\KasperskyLab",
      "IfExists": true
    },
    "KasperskyReg": {
      "FullPath": "System\\CurrentControlSet\\Services\\klhk\\Parameters",
      "ValueName": "UseVtHardware"
    },
    "KingsoftInstalledKey": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Kingsoft Internet Security",
      "IfExists": true
    },
    "KingsoftInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Kingsoft Internet Security",
      "IfExists": true
    },
    "KioskMode": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\AssignedAccessCsp\\AutoLogonAccount",
      "ValueName": "ConfigSource",
      "RegValueType": "REG_DWORD"
    },
    "LCUVer": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
      "ValueName": "LCUVer"
    },
    "LenovoInstalledKey": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{A9861883-31C5-4324-BD9A-DC9527EEB675}_is1",
      "IfExists": true
    },
    "LenovoInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{A9861883-31C5-4324-BD9A-DC9527EEB675}_is1",
      "IfExists": true
    },
    "MalwarebytesInstalledKey": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1",
      "IfExists": true
    },
    "MalwarebytesInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1",
      "IfExists": true
    },
    "McAfeeInstalledKey": {
      "FullPath": "SOFTWARE\\SOFTWARE\\McAfee\\MSC\\AppInfo\\Substitute\\QueryParams",
      "IfExists": true
    },
    "McAfeeInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\McAfee\\MSC\\AppInfo\\Substitute\\QueryParams",
      "IfExists": true
    },
    "MTPTargetingInfo": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Platform\\MTPTargetingInfo",
      "ValueName": "TargetRing"
    },
    "OEMModelBaseBoard": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "HARDWARE\\DESCRIPTION\\System\\BIOS",
      "ValueName": "BaseBoardProduct",
      "RegValueType": "REG_SZ"
    },
    "OemPartnerRing": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Platform\\DeviceTargetingInfo",
      "ValueName": "TargetRing",
      "RegValueType": "REG_SZ"
    },
    "OobeSeeker": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\Updates",
      "ValueName": "OOBEUpdateStarted"
    },
    "OSDataDriverPartnerRing": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "OSData\\SOFTWARE\\Microsoft\\DriverFlighting\\Partner",
      "ValueName": "TargetRing",
      "RegValueType": "REG_SZ"
    },
    "OSRollbackBuild": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade\\Rollback",
      "ValueName": "BuildString",
      "RegValueType": "REG_SZ"
    },
    "OSRollbackCount": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade\\Rollback",
      "ValueName": "Count",
      "RegValueType": "REG_DWORD"
    },
    "OSRollbackDate": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade\\Rollback",
      "ValueName": "DateStamp",
      "RegValueType": "REG_DWORD"
    },
    "PandaInstalledKey": {
      "FullPath": "SOFTWARE\\Panda Software\\Setup",
      "IfExists": true
    },
    "PandaInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Panda Software\\Setup",
      "IfExists": true
    },
    "PausedFeatureStatus": {
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UpdatePolicy\\Settings",
      "ValueName": "PausedFeatureStatus"
    },
    "PausedQualityStatus": {
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UpdatePolicy\\Settings",
      "ValueName": "PausedQualityStatus"
    },
    "PlayFabPartyRelay": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\PlayFabPartyRelay",
      "IfExists": true
    },
    "PonchAllow": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\QualityCompat",
      "ValueName": "cadca5fe-87d3-4b96-b7fb-a231484277cc",
      "RegValueType": "REG_DWORD"
    },
    "PonchAllowKey": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\QualityCompat\\cadca5fe-87d3-4b96-b7fb-a231484277cc",
      "IfExists": true
    },
    "PonchAllowWow": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\QualityCompat",
      "ValueName": "cadca5fe-87d3-4b96-b7fb-a231484277cc"
    },
    "PonchAllowWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\QualityCompat\\cadca5fe-87d3-4b96-b7fb-a231484277cc",
      "IfExists": true
    },
    "PonchBlock": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\QualityCompat",
      "ValueName": "65d75b03-6f4d-46e9-b870-517731e06cf9",
      "RegValueType": "REG_DWORD"
    },
    "PreviewBuildsManagerEnabled": {
      "FullPath": "SOFTWARE\\Microsoft\\WindowsSelfhost\\Manager",
      "ValueName": "ArePreviewBuildsAllowed"
    },
    "QUDeadline": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
      "ValueName": "ConfigureDeadlineForQualityUpdates",
      "RegValueType": "REG_DWORD"
    },
    "QUDeadlineMDM": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\Update",
      "ValueName": "ConfigureDeadlineForQualityUpdates",
      "RegValueType": "REG_DWORD"
    },
    "QuickhealInstalledKey1": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Servicescatflt",
      "IfExists": true
    },
    "QuickhealInstalledKey2": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\scanner.exe",
      "IfExists": true
    },
    "RecoveredFromBuild": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "Software\\Microsoft\\WindowsSelfHost\\Applicability\\RecoveredFrom",
      "ValueName": "LastBuild",
      "RegValueType": "REG_DWORD"
    },
    "RecoveredOnDate": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "Software\\Microsoft\\WindowsSelfHost\\Applicability\\RecoveredFrom",
      "ValueName": "DateStamp",
      "RegValueType": "REG_DWORD"
    },
    "ReleaseType": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo",
      "ValueName": "ReleaseType",
      "RegValueType": "REG_SZ"
    },
    "SmartActiveHoursState": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings",
      "ValueName": "SmartActiveHoursState",
      "RegValueType": "REG_DWORD"
    },
    "SophosInstalledKey1": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\SAVService",
      "IfExists": true
    },
    "SophosInstalledKey2": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\hmpalertsvc",
      "IfExists": true
    },
    "Steam": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Classes\\Steam",
      "ValueName": "",
      "RegValueType": "REG_SZ"
    },
    "SymantecInstalledKey": {
      "FullPath": "SOFTWARE\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}",
      "IfExists": true
    },
    "SymantecInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}",
      "IfExists": true
    },
    "TargetReleaseVersionGP": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
      "ValueName": "TargetReleaseVersionInfo",
      "RegValueType": "REG_SZ"
    },
    "TargetReleaseVersionMDM": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\Update",
      "ValueName": "TargetReleaseVersion",
      "RegValueType": "REG_SZ"
    },
    "TencentInstalledKey": {
      "FullPath": "SOFTWARE\\Tencent\\QQPCMgr",
      "IfExists": true
    },
    "TencentInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Tencent\\QQPCMgr",
      "IfExists": true
    },
    "TencentReg": {
      "FullPath": "SYSTEM\\CurrentControlSet\\services\\TesSafe",
      "ValueName": "LoadStartTime"
    },
    "TencentType": {
      "FullPath": "SYSTEM\\CurrentControlSet\\services\\TesSafe",
      "ValueName": "Type"
    },
    "ThreatTrackInstalledKey": {
      "FullPath": "SOFTWARE\\SBAMSvc",
      "IfExists": true
    },
    "ThreatTrackInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\SBAMSvc",
      "IfExists": true
    },
    "TrendInstalledKey": {
      "FullPath": "SOFTWARE\\TrendMicro",
      "IfExists": true
    },
    "TrendInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\TrendMicro",
      "IfExists": true
    },
    "UHSEnrolled": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
      "ValueName": "UHSEnrolled",
      "RegValueType": "REG_SZ",
      "IfExists": true
    },
    "UninstallActive": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "System\\Setup",
      "ValueName": "UninstallActive",
      "RegValueType": "REG_DWORD"
    },
    "UpdateOfferedDays": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WaaSAssessment\\Cache\\",
      "ValueName": "UpToDateDays",
      "RegValueType": "REG_DWORD"
    },
    "UpdatePreference": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
      "ValueName": "UpdatePreference",
      "RegValueType": "REG_DWORD"
    },
    "WebrootInstalledKey": {
      "FullPath": "SOFTWARE\\WRData",
      "IfExists": true
    },
    "WebrootInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\WRData",
      "IfExists": true
    },
    "WindowsMixedReality": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services\\HoloLensSensors",
      "ValueName": "WdfMajorVersion",
      "RegValueType": "REG_DWORD"
    }
  },
  "FileInfo": {
    "AvastVer": {
      "Path": "\\system32\\Drivers\\aswVmm.sys",
      "FolderGuid": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
    },
    "AvgVer": {
      "Path": "\\system32\\Drivers\\avgVmm.sys",
      "FolderGuid": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
    },
    "BullguardInstalledVer": {
      "Path": "\\BullGuard Ltd\\BullGuard\\BullGuard.exe",
      "IfExists": true,
      "FolderGuid": "{905E63B6-C1BF-494E-B29C-65B732D3D21A}"
    },
    "CortanaAppVer": {
      "Path": "\\WindowsApps\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\CortanaApp.View.exe",
      "FolderGuid": "{905E63B6-C1BF-494E-B29C-65B732D3D21A}"
    },
    "CortanaAppVerTest": {
      "Path": "\\WindowsApps\\3242f7d9-db60-4380-a379-4205ea768bfc_1.0.0.0_x64__zs4v8rx04ex0m\\UndockingTestApp.exe",
      "FolderGuid": "{905E63B6-C1BF-494E-B29C-65B732D3D21A}"
    },
    "EsetVer": {
      "Path": "\\drivers\\ehdrv.sys",
      "FolderGuid": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"
    },
    "GDataInstalledVer": {
      "Path": "\\drivers\\MiniIcpt.sys",
      "IfExists": true,
      "FolderGuid": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"
    },
    "IsNotepadExePresent": {
      "Path": "%windir%\\system32\\notepad.exe",
      "IfExists": true
    },
    "K7InstalledVer": {
      "Path": "\\K7 Computing",
      "IfExists": true,
      "FolderGuid": "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"
    },
    "KasperskyVer": {
      "Path": "\\system32\\Drivers\\klhk.sys",
      "FolderGuid": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
    },
    "PandaInstalledVer": {
      "Path": "\\Panda Security",
      "IfExists": true,
      "FolderGuid": "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"
    },
    "SkypeRoomSystem": {
      "Path": "%systemdrive%\\Recovery\\OEM\\$oem$\\$1\\Rigel\\x64\\Scripts\\Provisioning\\AutoUnattend.xml",
      "IfExists": true
    },
    "SymantecVer": {
      "Path": "\\Symantec\\Shared\\EENGINE\\eeCtrl.sys",
      "FolderGuid": "{DE974D24-D9C6-4D3E-BF91-F4455120B917}"
    },
    "SymantecVer64": {
      "Path": "\\Symantec\\Shared\\EENGINE\\eeCtrl64.sys",
      "FolderGuid": "{DE974D24-D9C6-4D3E-BF91-F4455120B917}"
    },
    "TobiiVer": {
      "Path": "\\Tobii\\Tobii EyeX Interaction\\Tobii.EyeX.Interaction.exe",
      "FolderGuid": "{905E63B6-C1BF-494E-B29C-65B732D3D21A}"
    },
    "TobiiVer1x86": {
      "Path": "\\Tobii\\tobii EyeX Interaction\\Tobii.EyeX.Interaction.exe",
      "FolderGuid": "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"
    },
    "TobiiVerx86": {
      "Path": "\\tobii EyeX Interaction\\Tobii.EyeX.Interaction.exe",
      "FolderGuid": "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"
    },
    "TrendInstalledVer": {
      "Path": "\\Trend Micro\\Titanium\\plugin\\plugVizor.dll",
      "IfExists": true,
      "FolderGuid": "{905E63B6-C1BF-494E-B29C-65B732D3D21A}"
    },
    "TrendMicroVer": {
      "Path": "\\drivers\\TMUMH.sys",
      "FolderGuid": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"
    },
    "WuClientVer": {
      "Path": "\\system32\\wuaueng.dll",
      "FolderGuid": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
    }
  },
  "Licensing": {
    "UpdateManagementGroup": {
      "Name": "UpdatePolicy-UpdateManagementGroup"
    }
  },
  "UpdatePolicy": {
    "BranchReadinessLevel": {
      "PolicyEnum": 5,
      "Enterprise": true
    },
    "BranchReadinessLevelSource": {
      "PolicyEnum": 5,
      "Enterprise": true,
      "UseSource": true
    },
    "DeferFeatureUpdatePeriodInDays": {
      "PolicyEnum": 9,
      "Enterprise": true
    },
    "DeferQualityUpdatePeriodInDays": {
      "PolicyEnum": 7,
      "Enterprise": true
    },
    "DisableDualScan": {
      "PolicyEnum": 42,
      "Enterprise": true
    },
    "EnableWUfBUpgradeGates": {
      "PolicyEnum": 51,
      "Enterprise": true
    },
    "TargetReleaseVersion": {
      "PolicyEnum": 50,
      "Enterprise": true
    },
    "UpdateServiceUrl": {
      "PolicyEnum": 12
    }
  },
  "Policy": {
    "DesiredOsVersion": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/DesiredUpdates/OsVersion"
    },
    "DesiredSystemManifestVersion": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/DesiredUpdates/SystemManifestVersion"
    },
    "DSS_Enrolled": {
      "Area": "Update",
      "Name": "EnableWUfBCloud"
    },
    "DucCustomPackageId": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/Enrollment/CustomPackageId"
    },
    "DucDeviceModelId": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/Enrollment/DeviceModelId"
    },
    "DucOemPartnerRing": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/Enrollment/OemPartnerRing"
    },
    "DucPublisherId": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/Enrollment/PublisherId"
    }
  },
  "WMI": {
    "FirstStorageSpaceDeviceId": {
      "Query": "SELECT DeviceID FROM Win32_DiskDrive WHERE Model = 'Microsoft Storage Space Device'",
      "Name": "DeviceID",
      "Timeout": 2000
    }
  }
}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsSelfHost\OneSettings]
"TargetingAttributesVerified"="{
  "Version": 108,
  "SchemaVersion": 1,
  "PartA": [
    "App",
    "AppVer",
    "AttrDataVer"
  ],
  "Default": [
    "DeviceFamily",
    "f:FlightRing",
    "t:OSVersionFull"
  ],
  "PartB": {
    "ACSOVERRIDE": [
      "OSArchitecture",
      "c:IsAlwaysOnAlwaysConnectedCapable"
    ],
    "CASSCLIENT": [
      "OSVersion",
      "c:OSEdition",
      "f:FlightRing"
    ],
    "CDM": [
      "ChassisTypeId",
      "r:CurrentBranch",
      "DeviceFamily",
      "f:FlightingBranchName",
      "f:FlightRing",
      "c:InstallLanguage",
      "c:IsDomainJoined",
      "t:IsTestLab",
      "OEMModel",
      "OSArchitecture",
      "OSVersion",
      "t:OSSkuId",
      "c:ProcessorIdentifier",
      "c:TelemetryLevel",
      "t:IsMsftOwned",
      "t:WCOSProductId",
      "c:OSUILocale",
      "c:CommercialId",
      "s:MinShellVersion",
      "s:MaxShellVersion",
      "c:ActivationChannel",
      "c:SCCMClientId",
      "c:IsCloudDomainJoined"
    ],
    "COMPATLOGGER": [
      "osVer",
      "ring",
      "deviceId"
    ],
    "CORTANA_GATEKEEPER": [
      "r:CurrentBranch",
      "f:FlightRing",
      "f:IsRetailOS"
    ],
    "CORTANAUWP": [
      "c:OSUILocale",
      "t:OSVersionFull",
      "v:CortanaAppVer"
    ],
    "CORTANAUWPTEST": [
      "+CORTANAUWP",
      "v:CortanaAppVerTest"
    ],
    "CTAC": [
      "+FSS"
    ],
    "DDC": [
      "+WU_STORE",
      "+_WU_PTI"
    ],
    "DXDB": [
      "DeviceFamily",
      "f:FlightRing",
      "r:IsHybridOrXGpu",
      "t:OSVersionFull"
    ],
    "EDGE_SERVICEUI": [
      "t:LocalDeviceID",
      "t:LocalUserID"
    ],
    "FCON": [
      "+CDM"
    ],
    "FSS": [
      "r:PreviewBuildsManagerEnabled",
      "f:BranchReadinessLevelRaw",
      "u:BranchReadinessLevelSource",
      "r:BuildFID",
      "t:DeviceFamily",
      "DeviceId",
      "c:EnablePreviewBuilds",
      "f:FlightingPolicyValue",
      "f:IsRetailOS",
      "f:ManagePreviewBuilds",
      "OSVersionFull",
      "t:WCOSProductId",
      "r:SmartActiveHoursState",
      "r:ActiveHoursStart",
      "r:ActiveHoursEnd"
    ],
    "FXIRISCLIENT": [
      "+IRISCLIENT"
    ],
    "IRISCLIENT": [
      "DeviceFamily",
      "OSVersion",
      "t:OSSkuId",
      "OSArchitecture",
      "c:TelemetryLevel",
      "f:FlightRing",
      "f:FlightingBranchName",
      "c:InternalPrimaryDisplayResolutionHorizontal",
      "c:InternalPrimaryDisplayResolutionVetical",
      "t:IsMsftOwned",
      "c:ChassisType",
      "c:IsDomainJoined",
      "c:ProcessorIdentifier",
      "c:CommercialId",
      "OEMModel",
      "c:OSUILocale",
      "c:OSEdition",
      "c:FlightIds",
      "t:LocalUserID",
      "r:CurrentBranch",
      "t:WCOSProductId"
    ],
    "MICROSOFT.WINDOWSFEEDBACKHUB_8WEKYB3D8BBWE": [
      "t:OSVersionFull",
      "t:IsTestLab",
      "f:FlightRing"
    ],
    "MITIGATION": [
      "t:DeviceFamily",
      "f:FlightRing",
      "c:FlightIds",
      "c:IsDomainJoined",
      "t:IsMsftOwned",
      "f:IsRetailOS",
      "t:IsTestLab",
      "IsVM",
      "OEMModel",
      "c:OSEdition",
      "t:OSSkuId",
      "t:OSVersionFull",
      "c:OSUILocale",
      "t:SMode",
      "f:IsFlightingEnabled",
      "c:FirmwareVersion",
      "c:TelemetryLevel",
      "f:FlightingBranchName",
      "r:CurrentBranch",
      "OSVersion",
      "w:FirstStorageSpaceDeviceId",
      "r:IsCldFltSyncRoots",
      "c:OSInstallType",
      "v:IsNotepadExePresent"
    ],
    "MLMOD": [
      "ChassisTypeId",
      "t:DeviceFamily",
      "f:FlightingBranchName",
      "f:FlightRing",
      "f:IsRetailOS",
      "t:OSSkuId",
      "t:OSVersionFull",
      "c:OSUILocale",
      "OSVersion",
      "c:TelemetryLevel",
      "r:CurrentBranch",
      "t:IsTestLab"
    ],
    "MTP": [
      "+_WU_OS_CORE"
    ],
    "MUSE": [
      "+_WU_FB",
      "ChassisTypeId",
      "deviceClass",
      "deviceId",
      "c:FlightIds",
      "locale",
      "ms",
      "os",
      "osVer",
      "ring",
      "sampleId",
      "sku",
      "r:DaysSince19H1FUOffer",
      "u:DisableDualScan",
      "u:UpdateServiceUrl",
      "c:CommercialId",
      "f:FlightingBranchName",
      "c:SystemVolumeTotalCapacity",
      "c:IsAlwaysOnAlwaysConnectedCapable",
      "c:ProcessorCores",
      "c:PrimaryDiskType",
      "c:TotalPhysicalRAM",
      "c:ProcessorClockSpeed"
    ],
    "NOISYHAMMER": [
      "+WU_OS"
    ],
    "SEDIMENTPACK": [
      "+WU_OS"
    ],
    "SERVICING_CBS": [
      "+WU"
    ],
    "SETUP360": [
      "t:OSSkuId",
      "f:FlightRing"
    ],
    "STORAGEGROVELER": [
      "a:Free",
      "c:TelemetryLevel",
      "f:FlightRing",
      "f:IsFlightingEnabled",
      "IsVM",
      "t:OSVersionFull"
    ],
    "UTC": [
      "+UTC_STATIC",
      "osVer",
      "locale",
      "ring",
      "f:PilotRing",
      "f:IsRetailOS",
      "ms",
      "expId",
      "t:SMode",
      "f:FlightingBranchName",
      "c:CommercialId",
      "r:IsFeedbackHubSelfhost"
    ],
    "UTC_STATIC": [
      "os",
      "deviceId",
      "sampleId",
      "deviceClass",
      "sku",
      "OEMModel",
      "OEMName_Uncleaned",
      "c:PrimaryDiskType",
      "c:ProcessorModel",
      "c:TotalPhysicalRAM"
    ],
    "UUS": [
      "OSVersion",
      "f:FlightRing",
      "t:IsTestLab",
      "t:OSVersionFull",
      "f:FlightingBranchName",
      "r:CurrentBranch"
    ],
    "WAASASSESSMENT": [
      "+WU_OS"
    ],
    "WAASMEDIC": [
      "os",
      "osVer",
      "ring",
      "deviceClass",
      "deviceId",
      "locale",
      "sku"
    ],
    "WOSC": [
      "t:DeviceFamily",
      "f:FlightRing",
      "f:IsFlightingEnabled",
      "t:IsMsftOwned",
      "t:LocalDeviceID",
      "t:OSSkuId",
      "c:OSUILocale",
      "t:OSVersionFull",
      "c:TelemetryLevel",
      "r:IsHybridOrXGpu",
      "r:PlayFabPartyRelay"
    ],
    "WPSHIFT": [
      "+MTP"
    ],
    "WU": [
      "+WU_OS",
      "r:DUInternal"
    ],
    "_WU_AV": [
      "r:AvastReg",
      "r:AvastBlackScreen",
      "v:AvastVer",
      "r:AvgReg",
      "v:AvgVer",
      "r:EsetReg",
      "v:EsetVer",
      "r:KasperskyReg",
      "v:KasperskyVer",
      "v:SymantecVer",
      "r:TencentReg",
      "r:TencentType",
      "r:AhnlabInstalledKey",
      "r:AvastInstalledKey",
      "r:AVGInstalledKey",
      "r:AviraInstalledKey",
      "r:BullguardInstalledKey",
      "r:ESETInstalledKey",
      "r:ESTSecurityInstalledKey",
      "r:FSecureInstalledKey",
      "v:GDataInstalledVer",
      "r:K7InstalledKey",
      "r:KasperskyInstalledKey",
      "r:KingsoftInstalledKey",
      "r:LenovoInstalledKey",
      "r:MalwarebytesInstalledKey",
      "r:McAfeeInstalledKey",
      "r:PandaInstalledKey",
      "r:QuickhealInstalledKey1",
      "r:SophosInstalledKey1",
      "r:SymantecInstalledKey",
      "r:TencentInstalledKey",
      "r:ThreatTrackInstalledKey",
      "r:TrendInstalledKey",
      "r:WebrootInstalledKey",
      "v:K7InstalledVer"
    ],
    "_WU_COMMON": [
      "r:CurrentBranch",
      "r:DefaultUserRegion",
      "DeviceFamily",
      "r:DriverPartnerRing",
      "r:FlightContent",
      "f:FlightingBranchName",
      "f:FlightRing",
      "HoloLens",
      "c:InstallationType",
      "c:InstallLanguage",
      "f:IsFlightingEnabled",
      "r:IsFlightingEnabled",
      "c:MobileOperatorCommercialized",
      "OEMModel",
      "OEMName_Uncleaned",
      "r:OemPartnerRing",
      "OSArchitecture",
      "OSVersion",
      "t:OSSkuId",
      "c:OSUILocale",
      "c:ProcessorManufacturer",
      "r:ReleaseType",
      "v:SkypeRoomSystem",
      "t:SMode",
      "c:TelemetryLevel",
      "r:WindowsMixedReality",
      "v:WuClientVer",
      "p:DucPublisherId",
      "p:DucDeviceModelId",
      "p:DucOemPartnerRing",
      "p:DucCustomPackageId",
      "p:DesiredOsVersion",
      "p:DesiredSystemManifestVersion"
    ],
    "_WU_FB": [
      "u:BranchReadinessLevel",
      "u:DeferQualityUpdatePeriodInDays",
      "u:DeferFeatureUpdatePeriodInDays",
      "r:PausedFeatureStatus",
      "r:PausedQualityStatus",
      "u:TargetReleaseVersion",
      "r:QUDeadline",
      "r:UpdatePreference",
      "r:UpdateOfferedDays"
    ],
    "WU_OS": [
      "+_WU_OS_CORE",
      "+_WU_FB"
    ],
    "_WU_OS_CORE": [
      "+_WU_COMMON",
      "+_WU_AV",
      "r:AhnLabKeyboard",
      "a:Bios",
      "r:BlockFeatureUpdates",
      "c:CommercialId",
      "a:DataVer_RS5",
      "r:DisconnectedStandby",
      "r:DchuNvidiaGrfxExists",
      "r:DchuNvidiaGrfxVen",
      "r:DchuIntelGrfxExists",
      "r:DchuIntelGrfxVen",
      "r:DchuAmdGrfxExists",
      "r:DchuAmdGrfxVen",
      "c:FirmwareVersion",
      "a:Free",
      "a:GStatus_RS3",
      "a:GStatus_RS4",
      "a:GStatus_RS5",
      "r:HidOverGattReg",
      "r:InstallDate",
      "c:IsDeviceRetailDemo",
      "c:IsPortableOperatingSystem",
      "IsVM",
      "c:OEMModelBaseBoard",
      "r:OobeSeeker",
      "r:OSRollbackBuild",
      "r:OSRollbackCount",
      "r:OSRollbackDate",
      "PhoneTargetingName",
      "r:PonchAllow",
      "r:PonchBlock",
      "c:ProcessorIdentifier",
      "r:RecoveredFromBuild",
      "r:RecoveredOnDate",
      "r:Steam",
      "v:TobiiVer",
      "v:TrendMicroVer",
      "r:UninstallActive",
      "l:UpdateManagementGroup",
      "a:UpgEx_RS3",
      "a:UpgEx_RS4",
      "a:UpgEx_RS5",
      "a:Version_RS5",
      "r:DisableWUfBOfferBlock",
      "a:UpgEx_19H1",
      "a:SdbVer_19H1",
      "a:GStatus_19H1",
      "a:GStatus_19H1Setup",
      "a:TimestampEpochString_19H1Setup",
      "a:GenTelRunTimestamp_19H1",
      "a:DataExpDateEpoch_19H1",
      "u:EnableWUfBUpgradeGates",
      "r:GStatusBlockIDs_All",
      "TimestampDelta_19H1Subtract19H1Setup",
      "DataExpDateDelta_19H1Subtract19H1Setup",
      "a:DataExpDateEpoch_19H1Setup",
      "a:TimestampEpochString_19H1",
      "r:IsContainerMgrInstalled",
      "r:IsWDAGEnabled",
      "r:MTPTargetingInfo",
      "r:EKB19H2InstallCount",
      "r:EKB19H2UnInstallCount",
      "r:EKB19H2InstallTimeEpoch",
      "r:EKB19H2UnInstallTimeEpoch",
      "r:BlockEdgeWithChromiumUpdate",
      "r:IsWDATPEnabled",
      "r:IsAutopilotRegistered",
      "r:EdgeWithChromiumInstallVersion",
      "r:EdgeWithChromiumInstallFailureCount",
      "r:IsEdgeWithChromiumInstalled",
      "r:KioskMode",
      "c:IsCloudDomainJoined",
      "c:IsDomainJoined",
      "p:DSS_Enrolled",
      "a:DataExpDateEpoch_20H1",
      "a:DataExpDateEpoch_20H1Setup",
      "a:GStatus_20H1",
      "a:GStatus_20H1Setup",
      "a:SdbVer_20H1",
      "a:TimestampEpochString_20H1",
      "a:TimestampEpochString_20H1Setup",
      "DataExpDateDelta_20H1Subtract20H1Setup",
      "TimestampDelta_20H1Subtract20H1Setup",
      "a:UpgEx_20H1",
      "r:AutopilotUpdateInProgress",
      "r:UHSEnrolled",
      "r:HotPatchEKBInstalled",
      "r:LCUVer",
      "c:isCommercial",
      "c:ActivationChannel",
      "c:IsMDMEnrolled",
      "c:SCCMClientID"
    ],
    "_WU_PTI": [
      "c:FrontFacingCameraResolution",
      "c:RearFacingCameraResolution",
      "c:TotalPhysicalRAM",
      "c:NFCProximity",
      "c:Magnetometer",
      "c:Gyroscope",
      "c:D3DMaxFeatureLevel",
      "c:InternalPrimaryDisplayResolutionHorizontal",
      "c:InternalPrimaryDisplayResolutionVetical"
    ],
    "WU_STORE": [
      "+_WU_COMMON",
      "r:AppChannels",
      "r:AppRMIDs",
      "u:BranchReadinessLevel"
    ]
  },
  "Required": [
    "App",
    "AppVer",
    "AttrDataVer"
  ],
  "Aliases": {
    "ChassisTypeId": "c:ChassisType",
    "DataExpDateDelta_19H1Subtract19H1Setup": "a:DataExpDateEpoch_19H1_Subtract_DataExpDateEpoch_19H1Setup",
    "DataExpDateDelta_20H1Subtract20H1Setup": "a:DataExpDateEpoch_20H1_Subtract_DataExpDateEpoch_20H1Setup",
    "deviceClass": "t:DeviceFamily",
    "deviceId": "t:LocalDeviceID",
    "DeviceId": "t:LocalDeviceID",
    "expId": "c:FlightIds",
    "FlightRing": "f:FlightRing",
    "IsVM": "a:ISVM",
    "locale": "c:OSUILocale",
    "ms": "t:IsMsftOwned",
    "OEMModel": "c:OEMModelNumber",
    "OEMName_Uncleaned": "c:OEMManufacturerName",
    "osVer": "t:OSVersionFull",
    "OSVersionFull": "t:OSVersionFull",
    "PhoneTargetingName": "c:OEMModelName",
    "ring": "f:FlightRing",
    "sampleId": "t:PopVal",
    "sku": "t:OSSkuId",
    "TimestampDelta_19H1Subtract19H1Setup": "a:TimestampEpochString_19H1_Subtract_TimestampEpochString_19H1Setup",
    "TimestampDelta_20H1Subtract20H1Setup": "a:TimestampEpochString_20H1_Subtract_TimestampEpochString_20H1Setup"
  },
  "Fallback": {
    "r:AhnlabInstalledKey": "r:AhnlabInstalledWowKey",
    "r:AvastBlackScreen": "r:AvgBlackScreen",
    "r:AvastInstalledKey": "r:AvastInstalledWowKey",
    "r:AVGInstalledKey": "r:AVGInstalledWowKey",
    "r:AviraInstalledKey": "r:AviraInstalledWowKey",
    "a:Bios": "a:Bios_RS3",
    "a:Bios_RS3": "a:Bios_RS4",
    "a:Bios_RS4": "a:Bios_RS5",
    "r:BlockFeatureUpdates": "r:BlockWUUpgrades",
    "r:BlockWUUpgrades": "r:BlockWUUpgradesWow",
    "r:BuildFID": "r:BuildFID_WCOS",
    "r:BuildFID_WCOS": "r:BuildFID_WCOS2",
    "r:BullguardInstalledKey": "v:BullguardInstalledVer",
    "r:DchuAmdGrfxVen": "r:DchuAmdGrfxVen2",
    "r:DchuAmdGrfxVen2": "r:DchuAmdGrfxDeletePending",
    "r:DchuIntelGrfxDeletePending": "r:DchuIntelGrfxNExists",
    "r:DchuIntelGrfxVen": "r:DchuIntelGrfxVen2",
    "r:DchuIntelGrfxVen2": "r:DchuIntelGrfxDeletePending",
    "r:DchuNvidiaGrfxVen": "r:DchuNvidiaGrfxVen2",
    "r:DchuNvidiaGrfxVen2": "r:DchuNvidiaGrfxDeletePending",
    "r:DriverPartnerRing": "r:OSDataDriverPartnerRing",
    "p:DSS_Enrolled": "r:DSS_EnrolledReg",
    "r:EdgeWithChromiumInstallFailureCount": "r:EdgeWithChromiumInstallFailureCountWow",
    "r:EdgeWithChromiumInstallVersion": "r:EdgeWithChromiumInstallVersionWow",
    "u:EnableWUfBUpgradeGates": "r:EnableWUfBUpgradeGatesRS5",
    "r:ESETInstalledKey": "r:ESETInstalledWowKey",
    "r:ESTSecurityInstalledKey": "r:ESTSecurityInstalledWowKey",
    "f:FlightingBranchName": "c:FlightingBranchName",
    "a:Free": "a:Free_RS3",
    "a:Free_RS3": "a:Free_RS4",
    "a:Free_RS4": "a:Free_RS5",
    "r:FSecureInstalledKey": "r:FSecureInstalledWowKey",
    "HoloLens": "r:WindowsMixedReality",
    "r:IsEdgeWithChromiumInstalled": "r:IsEdgeWithChromiumInstalledWow",
    "a:ISVM": "a:ISVM_RS3",
    "a:ISVM_RS3": "a:ISVM_RS4",
    "a:ISVM_RS4": "a:ISVM_RS5",
    "r:K7InstalledKey": "r:K7InstalledWowKey",
    "r:KasperskyInstalledKey": "r:KasperskyInstalledWowKey",
    "r:KingsoftInstalledKey": "r:KingsoftInstalledWowKey",
    "r:LenovoInstalledKey": "r:LenovoInstalledWowKey",
    "r:MalwarebytesInstalledKey": "r:MalwarebytesInstalledWowKey",
    "r:McAfeeInstalledKey": "r:McAfeeInstalledWowKey",
    "c:OEMModelBaseBoard": "r:OEMModelBaseBoard",
    "r:PandaInstalledKey": "r:PandaInstalledWowKey",
    "r:PandaInstalledWowKey": "v:PandaInstalledVer",
    "r:PonchAllow": "r:PonchAllowKey",
    "r:PonchAllowKey": "r:PonchAllowWow",
    "r:PonchAllowWow": "r:PonchAllowWowKey",
    "r:QUDeadline": "r:QUDeadlineMDM",
    "r:QuickhealInstalledKey1": "r:QuickhealInstalledKey2",
    "r:SophosInstalledKey1": "r:SophosInstalledKey2",
    "r:SymantecInstalledKey": "r:SymantecInstalledWowKey",
    "v:SymantecVer": "v:SymantecVer64",
    "u:TargetReleaseVersion": "r:TargetReleaseVersionGP",
    "r:TargetReleaseVersionGP": "r:TargetReleaseVersionMDM",
    "r:TencentInstalledKey": "r:TencentInstalledWowKey",
    "r:ThreatTrackInstalledKey": "r:ThreatTrackInstalledWowKey",
    "v:TobiiVer": "v:TobiiVerx86",
    "v:TobiiVerx86": "v:TobiiVer1x86",
    "r:TrendInstalledKey": "r:TrendInstalledWowKey",
    "r:TrendInstalledWowKey": "v:TrendInstalledVer",
    "r:WebrootInstalledKey": "r:WebrootInstalledWowKey"
  },
  "Transform": {
    "IsDomainJoined": {
      "Ignore": [
        "0"
      ]
    },
    "IsHybridOrXGpu": {
      "Ignore": [
        "0"
      ]
    },
    "IsMsftOwned": {
      "Ignore": [
        "0"
      ]
    },
    "IsPortableOperatingSystem": {
      "Ignore": [
        "0"
      ]
    },
    "IsTestLab": {
      "Ignore": [
        "0"
      ]
    },
    "IsVM": {
      "Ignore": [
        "0"
      ]
    },
    "OEMModel": {
      "SubLength": 100
    },
    "OEMName_Uncleaned": {
      "SubLength": 100
    },
    "PausedFeatureStatus": {
      "Ignore": [
        "0"
      ]
    },
    "PausedQualityStatus": {
      "Ignore": [
        "0"
      ]
    },
    "SMode": {
      "Ignore": [
        "0"
      ]
    }
  },
  "Registry": {
    "ActiveHoursEnd": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings",
      "ValueName": "ActiveHoursEnd",
      "RegValueType": "REG_DWORD"
    },
    "ActiveHoursStart": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings",
      "ValueName": "ActiveHoursStart",
      "RegValueType": "REG_DWORD"
    },
    "AhnlabInstalledKey": {
      "FullPath": "SOFTWARE\\Ahnlab",
      "IfExists": true
    },
    "AhnlabInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Ahnlab",
      "IfExists": true
    },
    "AhnLabKeyboard": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\Mkd2kfNt",
      "ValueName": "NbTpMsExist"
    },
    "AppChannels": {
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\WindowsStore\\Apps\\*",
      "ValueName": "ChannelId",
      "EncodingType": "Json"
    },
    "AppRMIDs": {
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\WindowsStore\\Apps\\*",
      "ValueName": "ReleaseManagementId",
      "EncodingType": "Json"
    },
    "AutopilotUpdateInProgress": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Provisioning\\AutopilotSettings\\VolatileAutopilotUpdate",
      "ValueName": "AutopilotUpdateInProgress",
      "RegValueType": "REG_DWORD"
    },
    "AvastBlackScreen": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\aswVmm\\Parameters",
      "ValueName": "Win10-1803"
    },
    "AvastInstalledKey": {
      "FullPath": "SOFTWARE\\Avast Software\\Avast",
      "IfExists": true
    },
    "AvastInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Avast Software\\Avast",
      "IfExists": true
    },
    "AvastReg": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\aswVmm\\Parameters",
      "ValueName": "QualityCompat"
    },
    "AvgBlackScreen": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\avgVmm\\Parameters",
      "ValueName": "Win10-1803"
    },
    "AVGInstalledKey": {
      "FullPath": "SOFTWARE\\AVG\\Antivirus",
      "IfExists": true
    },
    "AVGInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\AVG\\Antivirus",
      "IfExists": true
    },
    "AvgReg": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\avgVmm\\Parameters",
      "ValueName": "QualityCompat"
    },
    "AviraInstalledKey": {
      "FullPath": "SOFTWARE\\X-AVCSD\\Workstation\\Antivirus",
      "IfExists": true
    },
    "AviraInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\X-AVCSD\\Workstation\\Antivirus",
      "IfExists": true
    },
    "BlockEdgeWithChromiumUpdate": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\EdgeUpdate",
      "ValueName": "DoNotUpdateToEdgeWithChromium",
      "RegValueType": "REG_DWORD"
    },
    "BlockFeatureUpdates": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade",
      "ValueName": "BlockFeatureUpdates",
      "RegValueType": "REG_DWORD"
    },
    "BlockWUUpgrades": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows10Upgrader\\Volatile",
      "ValueName": "BlockWUUpgrades",
      "RegValueType": "REG_DWORD"
    },
    "BlockWUUpgradesWow": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows10Upgrader\\Volatile",
      "ValueName": "BlockWUUpgrades",
      "RegValueType": "REG_DWORD"
    },
    "BuildFID": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "Software\\Microsoft\\Windows\\CurrentVersion\\Flighting\\Build",
      "ValueName": "EsdFlightData",
      "RegValueType": "REG_SZ"
    },
    "BuildFID_WCOS": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "OSDATA\\Software\\Microsoft\\Windows\\CurrentVersion\\Flighting\\Build",
      "ValueName": "EsdFlightData",
      "RegValueType": "REG_SZ"
    },
    "BuildFID_WCOS2": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "OSDATA\\Microsoft\\Windows\\CurrentVersion\\Flighting\\Build",
      "ValueName": "EsdFlightData",
      "RegValueType": "REG_SZ"
    },
    "BullguardInstalledKey": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\BullGuard",
      "IfExists": true
    },
    "CurrentBranch": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
      "ValueName": "BuildBranch",
      "RegValueType": "REG_SZ"
    },
    "DaysSince19H1FUOffer": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\rempl\\irplugin",
      "ValueName": "DaysSinceLastOffer",
      "RegValueType": "REG_QWORD"
    },
    "DchuAmdGrfxDeletePending": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\amdkmdag",
      "ValueName": "DriverDelete"
    },
    "DchuAmdGrfxExists": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\amdkmdag",
      "IfExists": true
    },
    "DchuAmdGrfxVen": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\amdkmdag",
      "ValueName": "DCHUVen"
    },
    "DchuAmdGrfxVen2": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\amdkmdag\\Parameters",
      "ValueName": "DCHUVen"
    },
    "DchuIntelGrfxDeletePending": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\igfx",
      "ValueName": "DriverDelete"
    },
    "DchuIntelGrfxExists": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\igfx",
      "IfExists": true
    },
    "DchuIntelGrfxNExists": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\igfxn",
      "IfExists": true
    },
    "DchuIntelGrfxVen": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\igfx",
      "ValueName": "DCHUVen"
    },
    "DchuIntelGrfxVen2": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\igfx\\Parameters",
      "ValueName": "DCHUVen"
    },
    "DchuNvidiaGrfxDeletePending": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\nvlddmkm",
      "ValueName": "DriverDelete"
    },
    "DchuNvidiaGrfxExists": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\nvlddmkm",
      "IfExists": true
    },
    "DchuNvidiaGrfxVen": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\nvlddmkm",
      "ValueName": "DCHUVen"
    },
    "DchuNvidiaGrfxVen2": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\nvlddmkm\\Parameters",
      "ValueName": "DCHUVen"
    },
    "DefaultUserRegion": {
      "HKey": "HKEY_USERS",
      "FullPath": ".DEFAULT\\Control Panel\\International\\Geo",
      "ValueName": "Nation",
      "RegValueType": "REG_SZ"
    },
    "DisableWUfBOfferBlock": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UpdatePolicy\\Settings",
      "ValueName": "DisableWUfBOfferBlock",
      "RegValueType": "REG_DWORD"
    },
    "DisconnectedStandby": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\CurrentControlSet\\Control\\Power",
      "ValueName": "EnforceDisconnectedStandby",
      "RegValueType": "REG_DWORD"
    },
    "DriverPartnerRing": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\DriverFlighting\\Partner",
      "ValueName": "TargetRing",
      "RegValueType": "REG_SZ"
    },
    "DSS_EnrolledReg": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
      "ValueName": "EnableWUfBCloud",
      "RegValueType": "REG_DWORD"
    },
    "DUInternal": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Setup\\MoSetup",
      "ValueName": "DynamicUpdateInternalTest",
      "RegValueType": "REG_DWORD"
    },
    "EdgeWithChromiumInstallFailureCount": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\EdgeUpdate",
      "ValueName": "WindowsUpdateAttempts"
    },
    "EdgeWithChromiumInstallFailureCountWow": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Wow6432Node\\Microsoft\\EdgeUpdate",
      "ValueName": "WindowsUpdateAttempts"
    },
    "EdgeWithChromiumInstallVersion": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\EdgeUpdate",
      "ValueName": "WindowsUpdateVersion"
    },
    "EdgeWithChromiumInstallVersionWow": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Wow6432Node\\Microsoft\\EdgeUpdate",
      "ValueName": "WindowsUpdateVersion"
    },
    "EKB19H2InstallCount": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Setup\\FeatureStaging\\20455539\\2",
      "ValueName": "Count"
    },
    "EKB19H2InstallTimeEpoch": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Setup\\FeatureStaging\\20455539\\2",
      "ValueName": "Timestamp"
    },
    "EKB19H2UnInstallCount": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Setup\\FeatureStaging\\20455539\\0",
      "ValueName": "Count"
    },
    "EKB19H2UnInstallTimeEpoch": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Setup\\FeatureStaging\\20455539\\0",
      "ValueName": "Timestamp"
    },
    "EnableWUfBUpgradeGatesRS5": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "Software\\Microsoft\\Windows NT\\CurrentVersion\\502505fe-762c-4e80-911e-0c3fa4c63fb0",
      "ValueName": "DataRequireGatedScanForFeatureUpdates",
      "RegValueType": "REG_DWORD"
    },
    "ESETInstalledKey": {
      "FullPath": "SOFTWARE\\ESET\\ESET Security",
      "IfExists": true
    },
    "ESETInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\ESET\\ESET Security",
      "IfExists": true
    },
    "EsetReg": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\ehdrv\\Parameters",
      "ValueName": "WindowsCompatibilityLevel",
      "RegValueType": "REG_DWORD"
    },
    "ESTSecurityInstalledKey": {
      "FullPath": "SOFTWARE\\ESTsoft",
      "IfExists": true
    },
    "ESTSecurityInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\ESTsoft",
      "IfExists": true
    },
    "FlightContent": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability",
      "ValueName": "ContentType",
      "RegValueType": "REG_SZ"
    },
    "FSecureInstalledKey": {
      "FullPath": "SOFTWARE\\F-Secure\\OneClient",
      "IfExists": true
    },
    "FSecureInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\F-Secure\\OneClient",
      "IfExists": true
    },
    "GStatusBlockIDs_All": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Appraiser\\GWX",
      "ValueName": "SdbEntries",
      "RegValueType": "REG_SZ"
    },
    "HidOverGattReg": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\PnpLockdownFiles\\%SystemRoot%/System32/drivers/UMDF/Microsoft.Bluetooth.Profiles.HidOverGatt.dll",
      "ValueName": "Source",
      "RegValueType": "REG_SZ"
    },
    "HotPatchEKBInstalled": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hotpatch.amd64",
      "IfExists": true
    },
    "InstallDate": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
      "ValueName": "InstallDate",
      "RegValueType": "REG_DWORD"
    },
    "IsAutopilotRegistered": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Provisioning\\AutopilotPolicyCache",
      "ValueName": "ProfileAvailable",
      "RegValueType": "REG_DWORD"
    },
    "IsFlightingEnabled": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability",
      "ValueName": "IsBuildFlightingEnabled",
      "RegValueType": "REG_DWORD"
    },
    "IsCldFltSyncRoots": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager\\*",
      "IfExists": true
    },
    "IsContainerMgrInstalled": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\CmService",
      "IfExists": true
    },
    "IsEdgeWithChromiumInstalled": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}",
      "IfExists": true
    },
    "IsEdgeWithChromiumInstalledWow": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Wow6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}",
      "IfExists": true
    },
    "IsFeedbackHubSelfhost": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Diagnostics\\DiagTrack\\Partners\\IsFeedbackHubSelfhost",
      "IfExists": true
    },
    "IsHybridOrXGpu": {
      "FullPath": "SOFTWARE\\Microsoft\\DirectX",
      "ValueName": "HybridDeviceApplicableForDxDbGpuPreferences"
    },
    "IsWDAGEnabled": {
      "FullPath": "SYSTEM\\ControlSet001\\Services\\hvsics",
      "IfExists": true
    },
    "IsWDATPEnabled": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows Advanced Threat Protection\\Status",
      "ValueName": "OnboardingState"
    },
    "K7InstalledKey": {
      "FullPath": "SOFTWARE\\K7 Computing",
      "IfExists": true
    },
    "K7InstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\K7 Computing",
      "IfExists": true
    },
    "KasperskyInstalledKey": {
      "FullPath": "SOFTWARE\\KasperskyLab",
      "IfExists": true
    },
    "KasperskyInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\KasperskyLab",
      "IfExists": true
    },
    "KasperskyReg": {
      "FullPath": "System\\CurrentControlSet\\Services\\klhk\\Parameters",
      "ValueName": "UseVtHardware"
    },
    "KingsoftInstalledKey": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Kingsoft Internet Security",
      "IfExists": true
    },
    "KingsoftInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Kingsoft Internet Security",
      "IfExists": true
    },
    "KioskMode": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\AssignedAccessCsp\\AutoLogonAccount",
      "ValueName": "ConfigSource",
      "RegValueType": "REG_DWORD"
    },
    "LCUVer": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
      "ValueName": "LCUVer"
    },
    "LenovoInstalledKey": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{A9861883-31C5-4324-BD9A-DC9527EEB675}_is1",
      "IfExists": true
    },
    "LenovoInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{A9861883-31C5-4324-BD9A-DC9527EEB675}_is1",
      "IfExists": true
    },
    "MalwarebytesInstalledKey": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1",
      "IfExists": true
    },
    "MalwarebytesInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1",
      "IfExists": true
    },
    "McAfeeInstalledKey": {
      "FullPath": "SOFTWARE\\SOFTWARE\\McAfee\\MSC\\AppInfo\\Substitute\\QueryParams",
      "IfExists": true
    },
    "McAfeeInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\McAfee\\MSC\\AppInfo\\Substitute\\QueryParams",
      "IfExists": true
    },
    "MTPTargetingInfo": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Platform\\MTPTargetingInfo",
      "ValueName": "TargetRing"
    },
    "OEMModelBaseBoard": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "HARDWARE\\DESCRIPTION\\System\\BIOS",
      "ValueName": "BaseBoardProduct",
      "RegValueType": "REG_SZ"
    },
    "OemPartnerRing": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SYSTEM\\Platform\\DeviceTargetingInfo",
      "ValueName": "TargetRing",
      "RegValueType": "REG_SZ"
    },
    "OobeSeeker": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\Updates",
      "ValueName": "OOBEUpdateStarted"
    },
    "OSDataDriverPartnerRing": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "OSData\\SOFTWARE\\Microsoft\\DriverFlighting\\Partner",
      "ValueName": "TargetRing",
      "RegValueType": "REG_SZ"
    },
    "OSRollbackBuild": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade\\Rollback",
      "ValueName": "BuildString",
      "RegValueType": "REG_SZ"
    },
    "OSRollbackCount": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade\\Rollback",
      "ValueName": "Count",
      "RegValueType": "REG_DWORD"
    },
    "OSRollbackDate": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade\\Rollback",
      "ValueName": "DateStamp",
      "RegValueType": "REG_DWORD"
    },
    "PandaInstalledKey": {
      "FullPath": "SOFTWARE\\Panda Software\\Setup",
      "IfExists": true
    },
    "PandaInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Panda Software\\Setup",
      "IfExists": true
    },
    "PausedFeatureStatus": {
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UpdatePolicy\\Settings",
      "ValueName": "PausedFeatureStatus"
    },
    "PausedQualityStatus": {
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UpdatePolicy\\Settings",
      "ValueName": "PausedQualityStatus"
    },
    "PlayFabPartyRelay": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\PlayFabPartyRelay",
      "IfExists": true
    },
    "PonchAllow": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\QualityCompat",
      "ValueName": "cadca5fe-87d3-4b96-b7fb-a231484277cc",
      "RegValueType": "REG_DWORD"
    },
    "PonchAllowKey": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\QualityCompat\\cadca5fe-87d3-4b96-b7fb-a231484277cc",
      "IfExists": true
    },
    "PonchAllowWow": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\QualityCompat",
      "ValueName": "cadca5fe-87d3-4b96-b7fb-a231484277cc"
    },
    "PonchAllowWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\QualityCompat\\cadca5fe-87d3-4b96-b7fb-a231484277cc",
      "IfExists": true
    },
    "PonchBlock": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\QualityCompat",
      "ValueName": "65d75b03-6f4d-46e9-b870-517731e06cf9",
      "RegValueType": "REG_DWORD"
    },
    "PreviewBuildsManagerEnabled": {
      "FullPath": "SOFTWARE\\Microsoft\\WindowsSelfhost\\Manager",
      "ValueName": "ArePreviewBuildsAllowed"
    },
    "QUDeadline": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
      "ValueName": "ConfigureDeadlineForQualityUpdates",
      "RegValueType": "REG_DWORD"
    },
    "QUDeadlineMDM": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\Update",
      "ValueName": "ConfigureDeadlineForQualityUpdates",
      "RegValueType": "REG_DWORD"
    },
    "QuickhealInstalledKey1": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Servicescatflt",
      "IfExists": true
    },
    "QuickhealInstalledKey2": {
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\scanner.exe",
      "IfExists": true
    },
    "RecoveredFromBuild": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "Software\\Microsoft\\WindowsSelfHost\\Applicability\\RecoveredFrom",
      "ValueName": "LastBuild",
      "RegValueType": "REG_DWORD"
    },
    "RecoveredOnDate": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "Software\\Microsoft\\WindowsSelfHost\\Applicability\\RecoveredFrom",
      "ValueName": "DateStamp",
      "RegValueType": "REG_DWORD"
    },
    "ReleaseType": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo",
      "ValueName": "ReleaseType",
      "RegValueType": "REG_SZ"
    },
    "SmartActiveHoursState": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings",
      "ValueName": "SmartActiveHoursState",
      "RegValueType": "REG_DWORD"
    },
    "SophosInstalledKey1": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\SAVService",
      "IfExists": true
    },
    "SophosInstalledKey2": {
      "FullPath": "SYSTEM\\CurrentControlSet\\Services\\hmpalertsvc",
      "IfExists": true
    },
    "Steam": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Classes\\Steam",
      "ValueName": "",
      "RegValueType": "REG_SZ"
    },
    "SymantecInstalledKey": {
      "FullPath": "SOFTWARE\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}",
      "IfExists": true
    },
    "SymantecInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Norton\\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}",
      "IfExists": true
    },
    "TargetReleaseVersionGP": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
      "ValueName": "TargetReleaseVersionInfo",
      "RegValueType": "REG_SZ"
    },
    "TargetReleaseVersionMDM": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\Update",
      "ValueName": "TargetReleaseVersion",
      "RegValueType": "REG_SZ"
    },
    "TencentInstalledKey": {
      "FullPath": "SOFTWARE\\Tencent\\QQPCMgr",
      "IfExists": true
    },
    "TencentInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\Tencent\\QQPCMgr",
      "IfExists": true
    },
    "TencentReg": {
      "FullPath": "SYSTEM\\CurrentControlSet\\services\\TesSafe",
      "ValueName": "LoadStartTime"
    },
    "TencentType": {
      "FullPath": "SYSTEM\\CurrentControlSet\\services\\TesSafe",
      "ValueName": "Type"
    },
    "ThreatTrackInstalledKey": {
      "FullPath": "SOFTWARE\\SBAMSvc",
      "IfExists": true
    },
    "ThreatTrackInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\SBAMSvc",
      "IfExists": true
    },
    "TrendInstalledKey": {
      "FullPath": "SOFTWARE\\TrendMicro",
      "IfExists": true
    },
    "TrendInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\TrendMicro",
      "IfExists": true
    },
    "UHSEnrolled": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
      "ValueName": "UHSEnrolled",
      "RegValueType": "REG_SZ",
      "IfExists": true
    },
    "UninstallActive": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "System\\Setup",
      "ValueName": "UninstallActive",
      "RegValueType": "REG_DWORD"
    },
    "UpdateOfferedDays": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WaaSAssessment\\Cache\\",
      "ValueName": "UpToDateDays",
      "RegValueType": "REG_DWORD"
    },
    "UpdatePreference": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
      "ValueName": "UpdatePreference",
      "RegValueType": "REG_DWORD"
    },
    "WebrootInstalledKey": {
      "FullPath": "SOFTWARE\\WRData",
      "IfExists": true
    },
    "WebrootInstalledWowKey": {
      "FullPath": "SOFTWARE\\WOW6432Node\\WRData",
      "IfExists": true
    },
    "WindowsMixedReality": {
      "HKey": "HKEY_LOCAL_MACHINE",
      "FullPath": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services\\HoloLensSensors",
      "ValueName": "WdfMajorVersion",
      "RegValueType": "REG_DWORD"
    }
  },
  "FileInfo": {
    "AvastVer": {
      "Path": "\\system32\\Drivers\\aswVmm.sys",
      "FolderGuid": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
    },
    "AvgVer": {
      "Path": "\\system32\\Drivers\\avgVmm.sys",
      "FolderGuid": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
    },
    "BullguardInstalledVer": {
      "Path": "\\BullGuard Ltd\\BullGuard\\BullGuard.exe",
      "IfExists": true,
      "FolderGuid": "{905E63B6-C1BF-494E-B29C-65B732D3D21A}"
    },
    "CortanaAppVer": {
      "Path": "\\WindowsApps\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\CortanaApp.View.exe",
      "FolderGuid": "{905E63B6-C1BF-494E-B29C-65B732D3D21A}"
    },
    "CortanaAppVerTest": {
      "Path": "\\WindowsApps\\3242f7d9-db60-4380-a379-4205ea768bfc_1.0.0.0_x64__zs4v8rx04ex0m\\UndockingTestApp.exe",
      "FolderGuid": "{905E63B6-C1BF-494E-B29C-65B732D3D21A}"
    },
    "EsetVer": {
      "Path": "\\drivers\\ehdrv.sys",
      "FolderGuid": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"
    },
    "GDataInstalledVer": {
      "Path": "\\drivers\\MiniIcpt.sys",
      "IfExists": true,
      "FolderGuid": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"
    },
    "IsNotepadExePresent": {
      "Path": "%windir%\\system32\\notepad.exe",
      "IfExists": true
    },
    "K7InstalledVer": {
      "Path": "\\K7 Computing",
      "IfExists": true,
      "FolderGuid": "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"
    },
    "KasperskyVer": {
      "Path": "\\system32\\Drivers\\klhk.sys",
      "FolderGuid": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
    },
    "PandaInstalledVer": {
      "Path": "\\Panda Security",
      "IfExists": true,
      "FolderGuid": "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"
    },
    "SkypeRoomSystem": {
      "Path": "%systemdrive%\\Recovery\\OEM\\$oem$\\$1\\Rigel\\x64\\Scripts\\Provisioning\\AutoUnattend.xml",
      "IfExists": true
    },
    "SymantecVer": {
      "Path": "\\Symantec\\Shared\\EENGINE\\eeCtrl.sys",
      "FolderGuid": "{DE974D24-D9C6-4D3E-BF91-F4455120B917}"
    },
    "SymantecVer64": {
      "Path": "\\Symantec\\Shared\\EENGINE\\eeCtrl64.sys",
      "FolderGuid": "{DE974D24-D9C6-4D3E-BF91-F4455120B917}"
    },
    "TobiiVer": {
      "Path": "\\Tobii\\Tobii EyeX Interaction\\Tobii.EyeX.Interaction.exe",
      "FolderGuid": "{905E63B6-C1BF-494E-B29C-65B732D3D21A}"
    },
    "TobiiVer1x86": {
      "Path": "\\Tobii\\tobii EyeX Interaction\\Tobii.EyeX.Interaction.exe",
      "FolderGuid": "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"
    },
    "TobiiVerx86": {
      "Path": "\\tobii EyeX Interaction\\Tobii.EyeX.Interaction.exe",
      "FolderGuid": "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}"
    },
    "TrendInstalledVer": {
      "Path": "\\Trend Micro\\Titanium\\plugin\\plugVizor.dll",
      "IfExists": true,
      "FolderGuid": "{905E63B6-C1BF-494E-B29C-65B732D3D21A}"
    },
    "TrendMicroVer": {
      "Path": "\\drivers\\TMUMH.sys",
      "FolderGuid": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"
    },
    "WuClientVer": {
      "Path": "\\system32\\wuaueng.dll",
      "FolderGuid": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
    }
  },
  "Licensing": {
    "UpdateManagementGroup": {
      "Name": "UpdatePolicy-UpdateManagementGroup"
    }
  },
  "UpdatePolicy": {
    "BranchReadinessLevel": {
      "PolicyEnum": 5,
      "Enterprise": true
    },
    "BranchReadinessLevelSource": {
      "PolicyEnum": 5,
      "Enterprise": true,
      "UseSource": true
    },
    "DeferFeatureUpdatePeriodInDays": {
      "PolicyEnum": 9,
      "Enterprise": true
    },
    "DeferQualityUpdatePeriodInDays": {
      "PolicyEnum": 7,
      "Enterprise": true
    },
    "DisableDualScan": {
      "PolicyEnum": 42,
      "Enterprise": true
    },
    "EnableWUfBUpgradeGates": {
      "PolicyEnum": 51,
      "Enterprise": true
    },
    "TargetReleaseVersion": {
      "PolicyEnum": 50,
      "Enterprise": true
    },
    "UpdateServiceUrl": {
      "PolicyEnum": 12
    }
  },
  "Policy": {
    "DesiredOsVersion": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/DesiredUpdates/OsVersion"
    },
    "DesiredSystemManifestVersion": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/DesiredUpdates/SystemManifestVersion"
    },
    "DSS_Enrolled": {
      "Area": "Update",
      "Name": "EnableWUfBCloud"
    },
    "DucCustomPackageId": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/Enrollment/CustomPackageId"
    },
    "DucDeviceModelId": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/Enrollment/DeviceModelId"
    },
    "DucOemPartnerRing": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/Enrollment/OemPartnerRing"
    },
    "DucPublisherId": {
      "LocUri": "./Device/Vendor/MSFT/DeviceUpdateCenter/Enrollment/PublisherId"
    }
  },
  "WMI": {
    "FirstStorageSpaceDeviceId": {
      "Query": "SELECT DeviceID FROM Win32_DiskDrive WHERE Model = 'Microsoft Storage Space Device'",
      "Name": "DeviceID",
      "Timeout": 2000
    }
  }
}"
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVAST Software]
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Browser\aswSP]
"LimitedRegistry"="\REGISTRY\USER\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\AVAST Software\Browser
\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Browser"
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Browser\aswSP]
"LimitedFolders"="\??\C:\Program Files (x86)\AVAST Software\Browser\
\??\C:\Users\SandeepandJaya\AppData\Local\AVAST Software\Browser\
\??\C:\ProgramData\AVAST Software\Browser\"
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVAST Software\OPM\data]
"avast"="0x65794A7764584E666247467A644639325A584266646A45694F6E736964476C745A5349364D5455354F544D344E544D344D697769646D4673496A6F794D483073496E42316331397359584E3058335A6C633139324D53493665794A306157316C496A6F784E546B354D7A67314D7A67794C434A32595777694F6A643966513D3D"
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\No Chrome Offer Until]
"AVAST Software"="20210129"
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\aswbIDSAgent]
"Path"=""C:\Program Files\AVAST Software\Avast\aswidsagent.exe""
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\aswbIDSAgent]
"Path.Org"=""C:\Program Files\AVAST Software\Avast\aswidsagent.exe""
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\aswbIDSAgent]
"Path.Win32"="C:\Program Files\AVAST Software\Avast\aswidsagent.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\avast! Antivirus]
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\avast! Antivirus]
"ServiceName"="avast! Antivirus"
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\avast! Antivirus]
"Path"=""C:\Program Files\AVAST Software\Avast\AvastSvc.exe""
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\avast! Antivirus]
"Path.Org"=""C:\Program Files\AVAST Software\Avast\AvastSvc.exe""
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\avast! Antivirus]
"Path.Win32"="C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\avast! Antivirus]
"DisplayName"="Avast Antivirus"
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\AvastWscReporter]
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\AvastWscReporter]
"ServiceName"="AvastWscReporter"
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\AvastWscReporter]
"Path"=""C:\Program Files\AVAST Software\Avast\wsc_proxy.exe" /runassvc /rpcserver"
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\AvastWscReporter]
"Path.Org"=""C:\Program Files\AVAST Software\Avast\wsc_proxy.exe" /runassvc /rpcserver"
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\AvastWscReporter]
"Path.Win32"="C:\Program Files\AVAST Software\Avast\wsc_proxy.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\AvastWscReporter]
"DisplayName"="AvastWscReporter"
[HKEY_USERS\.DEFAULT\Software\AVAST Software]
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Avast Software]
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\362813f5_0]
""="{2}.\\?\hdaudio#func_01&ven_10ec&dev_0235&subsys_17aa36f1&rev_1000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\singlelineouttopo/00010001|\Device\HarddiskVolume3\Program Files\AVAST Software\Avast\AvastUI.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts]
"AvastHTML_https"="0"
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts]
"AvastHTML_http"="0"
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts]
"AvastHTML_.htm"="0"
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts]
"AvastHTML_.html"="0"
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts]
"AvastHTML_.pdf"="0"
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"avast! Antivirus"="6"
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"{6D809377-6AF0-444B-8957-A3773F02200E}\AVAST Software\Avast\setup\instup.exe"="1"
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files\AVAST Software\Avast\AvastUI.exe"="0x534143500100000000000000070000002800000088A3B4000D4BB50001000000000000000000000A00210000BFA2139DEDD1D3010000000000000000"
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\avast.com]
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.avast.com]
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\avast.com]
[HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.avast.com]
 
 
====== End of Search ======

  • 0

#22
sandybgood
Posted 13 October 2020 - 07:29 AM

sandybgood

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts

Hello Gary,

 

Wordwrap in my Notepad was unchecked earlier. I have checked the Wordwrap feature so that the output is more readable.

Do let me know if you want me to uncheck it and post the output (this is the earlier output I had posted). Rgds


  • 0

#23
Gary R
Posted 13 October 2020 - 08:27 AM

Gary R

    Trusted Helper

  • Malware Removal
  • 445 posts

OK, lets have a go at removing what's left of Avast on your machine ....

 

 

  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
  • Press Ctrl+y (Ctrl and y keys at the same time)
  • A blank randomly named .txt Notepad file will open.
  • Copy and paste the following into it  ....
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5.cat
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5.manifest
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128.cat
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128.manifest
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5158632ac9d8192f.cat
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5158632ac9d8192f.manifest
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_5638651cc6ac4862.cat
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_5638651cc6ac4862.manifest
C:\Windows\WinSxS\Manifests\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb.cat
C:\Windows\WinSxS\Manifests\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb.manifest
C:\Windows\WinSxS\Manifests\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e.cat
C:\Windows\WinSxS\Manifests\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e.manifest
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_99059a01de544235.cat
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_99059a01de544235.manifest
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_9de59bf3db287168.cat
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_9de59bf3db287168.manifest
C:\Windows\System32\Tasks_Migrated\Avast Emergency Update
C:\Windows\Prefetch\AVASTUI.EXE-19622E35.pf
C:\Users\SandeepandJaya\Desktop\Old Firefox Data\9g8e18yf.default-release\extensions\[email protected]
C:\Users\SandeepandJaya\Desktop\Old Firefox Data\9g8e18yf.default-release\extensions\[email protected]
C:\ProgramData\Intel\ShaderCache\AvastUI_0
C:\ProgramData\Intel\ShaderCache\AvastUI_1
C:\ProgramData\Intel\ShaderCache\AvastUI_2
C:\Program Files\WindowsApps\Microsoft.Office.Desktop_16051.13231.20262.0_x86__8wekyb3d8bbwe\Office16\1060\DataServices\+NovaPovezavaStrežnikaSQL.odc
C:\Windows\WinSxS\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5
C:\Windows\WinSxS\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128
C:\Windows\WinSxS\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb
C:\Windows\WinSxS\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e
C:\Windows\System32\Tasks_Migrated\Avast Software
[-HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avast]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AvastSvc_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AvastSvc_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_avast.vc140.crt_fcc99ee6193ebbca_none_020285fe6d6e0580]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_avast.vc140.mfc_fcc99ee6193ebbca_none_018be6966dc83925]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_none_ef17e13d91c55d96]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_none_eea141d5921f913b]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_avast.vc140.crt_fcc99ee6193ebbca_none_49afbcd581ea2e86]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_avast.vc140.mfc_fcc99ee6193ebbca_none_49391d6d8244622b]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_none_36c51814a641869c]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_none_364e78aca69bba41]
[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVAST Software]
[-HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\aswbIDSAgent]
[-HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\avast! Antivirus]
[-HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\AvastWscReporter]
[-HKEY_USERS\.DEFAULT\Software\AVAST Software]
[-HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Avast Software]
[-HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\avast.com]
[-HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.avast.com]
[-HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\avast.com]
[-HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.avast.com]
DeleteValue:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}|DISPLAYNAME
DeleteValue:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}|PRODUCTEXE
DeleteValue:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}|REPORTINGEXE
DeleteValue:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|AvastUI.exe
EmptyTemp:
Hosts:
  • Press Ctrl+s to save fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system


  • Now press the Fix button once and wait.
  • FRST will process fixlist.txt
  • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
  • Please post me the log

Next ....

 

 

I'd like you to run an AV scan for me ....

 

Download ESET Online Scanner and save it to your desktop.

  • Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
  • When the tool opens, click Get Started.
  • Read and accept the license agreement.
  • At the Welcome to ESET Online Scanner window, click Get Started.
  • Select whether you would like to send anonymous data to ESET.
  • Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
  • Click on the Full Scan option.
  • Select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
  • ESET will now begin scanning your computer. This may take some time.
  • When the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
  • ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. Click on Continue.
  • On the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
  • Open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.

 

 


  • 0

#24
sandybgood
Posted 13 October 2020 - 10:14 AM

sandybgood

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
Hello Gary, Here is the Fixlist log....
 
Fix result of Farbar Recovery Scan Tool (x64) Version: 11-10-2020
Ran by SandeepandJaya (13-10-2020 21:34:01) Run:3
Running from C:\Users\SandeepandJaya\Desktop
Loaded Profiles: SandeepandJaya
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5.cat
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5.manifest
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128.cat
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128.manifest
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5158632ac9d8192f.cat
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5158632ac9d8192f.manifest
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_5638651cc6ac4862.cat
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_5638651cc6ac4862.manifest
C:\Windows\WinSxS\Manifests\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb.cat
C:\Windows\WinSxS\Manifests\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb.manifest
C:\Windows\WinSxS\Manifests\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e.cat
C:\Windows\WinSxS\Manifests\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e.manifest
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_99059a01de544235.cat
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_99059a01de544235.manifest
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_9de59bf3db287168.cat
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_9de59bf3db287168.manifest
C:\Windows\System32\Tasks_Migrated\Avast Emergency Update
C:\Windows\Prefetch\AVASTUI.EXE-19622E35.pf
C:\Users\SandeepandJaya\Desktop\Old Firefox Data\9g8e18yf.default-release\extensions\[email protected]
C:\Users\SandeepandJaya\Desktop\Old Firefox Data\9g8e18yf.default-release\extensions\[email protected]
C:\ProgramData\Intel\ShaderCache\AvastUI_0
C:\ProgramData\Intel\ShaderCache\AvastUI_1
C:\ProgramData\Intel\ShaderCache\AvastUI_2
C:\Program Files\WindowsApps\Microsoft.Office.Desktop_16051.13231.20262.0_x86__8wekyb3d8bbwe\Office16\1060\DataServices\+NovaPovezavaStrežnikaSQL.odc
C:\Windows\WinSxS\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5
C:\Windows\WinSxS\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128
C:\Windows\WinSxS\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb
C:\Windows\WinSxS\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e
C:\Windows\System32\Tasks_Migrated\Avast Software
[-HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avast]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AvastSvc_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AvastSvc_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_avast.vc140.crt_fcc99ee6193ebbca_none_020285fe6d6e0580]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_avast.vc140.mfc_fcc99ee6193ebbca_none_018be6966dc83925]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_none_ef17e13d91c55d96]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_none_eea141d5921f913b]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_avast.vc140.crt_fcc99ee6193ebbca_none_49afbcd581ea2e86]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_avast.vc140.mfc_fcc99ee6193ebbca_none_49391d6d8244622b]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_none_36c51814a641869c]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_none_364e78aca69bba41]
[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVAST Software]
[-HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\aswbIDSAgent]
[-HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\avast! Antivirus]
[-HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\AvastWscReporter]
[-HKEY_USERS\.DEFAULT\Software\AVAST Software]
[-HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Avast Software]
[-HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\avast.com]
[-HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.avast.com]
[-HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\avast.com]
[-HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.avast.com]
DeleteValue:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}|DISPLAYNAME
DeleteValue:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}|PRODUCTEXE
DeleteValue:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}|REPORTINGEXE
DeleteValue:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|AvastUI.exe
EmptyTemp:
Hosts:
*****************
 
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5.cat => moved successfully
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5.manifest => moved successfully
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128.cat => moved successfully
C:\Windows\WinSxS\Manifests\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128.manifest => moved successfully
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5158632ac9d8192f.cat => moved successfully
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5158632ac9d8192f.manifest => moved successfully
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_5638651cc6ac4862.cat => moved successfully
C:\Windows\WinSxS\Manifests\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_5638651cc6ac4862.manifest => moved successfully
C:\Windows\WinSxS\Manifests\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb.cat => moved successfully
C:\Windows\WinSxS\Manifests\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb.manifest => moved successfully
C:\Windows\WinSxS\Manifests\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e.cat => moved successfully
C:\Windows\WinSxS\Manifests\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e.manifest => moved successfully
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_99059a01de544235.cat => moved successfully
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_99059a01de544235.manifest => moved successfully
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_9de59bf3db287168.cat => moved successfully
C:\Windows\WinSxS\Manifests\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_9de59bf3db287168.manifest => moved successfully
C:\Windows\System32\Tasks_Migrated\Avast Emergency Update => moved successfully
C:\Windows\Prefetch\AVASTUI.EXE-19622E35.pf => moved successfully
C:\Users\SandeepandJaya\Desktop\Old Firefox Data\9g8e18yf.default-release\extensions\[email protected] => moved successfully
C:\Users\SandeepandJaya\Desktop\Old Firefox Data\9g8e18yf.default-release\extensions\[email protected] => moved successfully
C:\ProgramData\Intel\ShaderCache\AvastUI_0 => moved successfully
C:\ProgramData\Intel\ShaderCache\AvastUI_1 => moved successfully
C:\ProgramData\Intel\ShaderCache\AvastUI_2 => moved successfully
C:\Program Files\WindowsApps\Microsoft.Office.Desktop_16051.13231.20262.0_x86__8wekyb3d8bbwe\Office16\1060\DataServices\+NovaPovezavaStrežnikaSQL.odc => moved successfully
C:\Windows\WinSxS\amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_5e69e83710ea31f5 => moved successfully
C:\Windows\WinSxS\amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_6349ea290dbe6128 => moved successfully
C:\Windows\WinSxS\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.28127.0_none_a6171f0e25665afb => moved successfully
C:\Windows\WinSxS\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.28127.0_none_aaf72100223a8a2e => moved successfully
C:\Windows\System32\Tasks_Migrated\Avast Software => moved successfully
HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avast => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AvastSvc_RASAPI32 => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AvastSvc_RASMANCS => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_avast.vc140.crt_fcc99ee6193ebbca_none_020285fe6d6e0580 => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_avast.vc140.mfc_fcc99ee6193ebbca_none_018be6966dc83925 => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_none_ef17e13d91c55d96 => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_none_eea141d5921f913b => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_avast.vc140.crt_fcc99ee6193ebbca_none_49afbcd581ea2e86 => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_avast.vc140.mfc_fcc99ee6193ebbca_none_49391d6d8244622b => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_none_36c51814a641869c => removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_none_364e78aca69bba41 => removed successfully
RegLink Found. Source: "" => Target: "HKLM\SOFTWARE\AVAST Software"
"HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVAST Software" => removed successfully
HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\aswbIDSAgent => removed successfully
HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\avast! Antivirus => removed successfully
HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\AvastWscReporter => removed successfully
HKEY_USERS\.DEFAULT\Software\AVAST Software => removed successfully
HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Avast Software => removed successfully
HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\avast.com => removed successfully
HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.avast.com => removed successfully
HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\avast.com => removed successfully
HKEY_USERS\S-1-5-21-1730742525-4092960748-1108651602-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.avast.com => removed successfully
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}\\DISPLAYNAME" => removed successfully
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}\\PRODUCTEXE" => removed successfully
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}\\REPORTINGEXE" => removed successfully
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\AvastUI.exe" => removed successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 10772480 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 6430119 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 279499 B
Edge => 0 B
Chrome => 114756746 B
Firefox => 43086977 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 3068 B
SandeepandJaya => 2891841 B
 
RecycleBin => 6268 B
EmptyTemp: => 170 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 21:34:55 ====

  • 0

#25
Gary R
Posted 13 October 2020 - 10:21 PM

Gary R

    Trusted Helper

  • Malware Removal
  • 445 posts

The Avast orphans appear to have been removed successfully, all I need from you now are the results from the E-Set scan.

 

If you have already run it, please post the results.

 

If not, please run it ASAP and post me the results.


  • 0

Advertisements

#26
sandybgood
Posted 14 October 2020 - 06:30 AM

sandybgood

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts

Sure Gary.. Am running it now. It looks like the process may require several hours. Shall post you the log once complete.


  • 0

#27
Gary R
Posted 14 October 2020 - 08:11 AM

Gary R

    Trusted Helper

  • Malware Removal
  • 445 posts

Yes, sadly the scan does take a long time to run, but it is very thorough, and will usually find anything if it's there.


  • 0

#28
sandybgood
Posted 14 October 2020 - 09:53 AM

sandybgood

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts

Hello Gary, Here is the ESET log..

 

14-10-2020 21:19:55
Files scanned: 374476
Detected files: 4
Cleaned files: 4
Total scan time 03:16:07
Scan status: Finished
 
 
C:\System Utilities and Cleaners\defragglersetup215.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting
C:\Users\SandeepandJaya\Downloads\BitTorrent.exe a variant of Win32/uTorrent.C potentially unwanted application,a variant of MSIL/WebCompanion.A potentially unwanted application,a variant of Win32/WebCompanion.B potentially unwanted application cleaned by deleting
D:\Downloads\WiseCare365(1).exe a variant of Win32/WiseCleaner.A potentially unwanted application cleaned by deleting
D:\Downloads\WiseCare365.exe a variant of Win32/WiseCleaner.A potentially unwanted application cleaned by deleting

  • 0

#29
sandybgood
Posted 14 October 2020 - 09:53 AM

sandybgood

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts

Hello Gary, Here is the ESET log..

 

14-10-2020 21:19:55
Files scanned: 374476
Detected files: 4
Cleaned files: 4
Total scan time 03:16:07
Scan status: Finished
 
 
C:\System Utilities and Cleaners\defragglersetup215.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting
C:\Users\SandeepandJaya\Downloads\BitTorrent.exe a variant of Win32/uTorrent.C potentially unwanted application,a variant of MSIL/WebCompanion.A potentially unwanted application,a variant of Win32/WebCompanion.B potentially unwanted application cleaned by deleting
D:\Downloads\WiseCare365(1).exe a variant of Win32/WiseCleaner.A potentially unwanted application cleaned by deleting
D:\Downloads\WiseCare365.exe a variant of Win32/WiseCleaner.A potentially unwanted application cleaned by deleting

  • 0

#30
Gary R
Posted 14 October 2020 - 03:33 PM

Gary R

    Trusted Helper

  • Malware Removal
  • 445 posts

So how's your computer running now ?

 

Any improvement ?


  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics


Also tagged with one or more of these keywords: Virus, Slowdown, Screen, Stuck

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP