Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToBackup]
"FVE2_Control"=hex(7):00,00
"FVE2_Log"=hex(7):00,00
"FVE2_VBB"=hex(7):00,00
"FVE2_Wipe"=hex(7):00,00
"FVE2_WipeInfo"=hex(7):00,00
"FVE2_WipeX"=hex(7):00,00
"FVE_Control"=hex(7):00,00
"FVE_Log"=hex(7):00,00
"FVE_Wipe"=hex(7):00,00
"Netlogon"=hex(7):00,00
"WER"=hex(7):00,00

[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToSnapshot]
"FVE"=hex(7):00,00
"FVE2_Wipe"=hex(7):00,00
"FVE2_WipeX"=hex(7):00,00

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\BitLocker\AutoDE]

;Dot4Print
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{49ce6ac8-6f86-11d2-b1e5-0080c72e74a2}]
"IconPath"=hex(7):00,00

;FDC
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{4d36e969-e325-11ce-bfc1-08002be10318}]
"IconPath"=hex(7):00,00

;Modem
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}]
"IconPath"=hex(7):00,00

;NetService
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{4d36e974-e325-11ce-bfc1-08002be10318}]
"IconPath"=hex(7):00,00

;NetTrans
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{4d36e975-e325-11ce-bfc1-08002be10318}]
"IconPath"=hex(7):00,00

;Printer
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{4d36e979-e325-11ce-bfc1-08002be10318}]
"IconPath"=hex(7):00,00

;FloppyDisk
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{4d36e980-e325-11ce-bfc1-08002be10318}]

;Biometric
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{53d29ef7-377c-4d14-864b-eb3a85769359}]
"IconPath"=hex(7):00,00

;Proximity
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{5630831c-06c9-4856-b327-f5d32586e060}]
"IconPath"=hex(7):00,00

;AudioProcessingObject
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{5989fce8-9cd0-467d-8a6a-5419e31529d4}]
"IconPath"=hex(7):00,00

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{5989fce8-9cd0-467d-8a6a-5419e31529d4}\Configuration]

;Infrared
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{6bdd1fc5-810f-11d0-bec7-08002be2092f}]
"UpperFilters"=hex(7):00,00
"IconPath"=hex(7):00,00

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{6bdd1fc5-810f-11d0-bec7-08002be2092f}\Configuration]

;TapeDrive
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{6d807884-7d21-11cf-801c-08002be10318}]
"IconPath"=hex(7):00,00

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{6d807884-7d21-11cf-801c-08002be10318}\Configuration]

;Volume
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}]
"LowerFilters"=hex(7):00,00

;61883
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{7ebefbc0-3200-11d2-b4c2-00a0c9697d07}]
"IconPath"=hex(7):00,00

;NetDriver
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{87ef9ad1-8f70-49ee-b215-ab1fcadcbe3c}]
"IconPath"=hex(7):00,00

;Camera
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{ca3e7ab9-b4c3-4ae6-8251-579ef933890f}]
"IconPath"=hex(7):00,00
"UpperFilters"=hex(7):00,00

[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{ca3e7ab9-b4c3-4ae6-8251-579ef933890f}\Configuration]

;Bluetooth
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974}]
"IconPath"=hex(7):00,00

[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\CrashControl]
"DumpFilters"=hex(7):00,00


[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\DmaSecurity\Default]

;[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Keyboard Layouts\*]

[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Lsa]
"auditbasedirectories"=-
"auditbaseobjects"=-
"Bounds"=-
"crashonauditfail"=-
"fullprivilegeauditing"=-

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Network\LightweightCallHandlers\PNIDUI]

;ms_server (Netserv.inf)
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{52564552-5345-414E-2DD4-CF8F7555A888}]

;ms_netbt_smb (nettcpip.inf)
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{53534D42-494F-5442-CC18-B25667ED6E1E}]


[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Minimal\AppMgmt]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Netlogon]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Minimal\StateRepository]

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
;@="Standard floppy disk controller"
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
;@="Floppy disk drive"


[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\AppMgmt]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\DnsCache]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\Eaphost]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\IKEEXT]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\LanmanServer]


[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\NetBIOS]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\NetBT]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\Netlogon]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\NlaSvc]

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\PolicyAgent]

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\StateRepository]

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]
;@="Standard floppy disk controller"

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]
;@="Floppy disk drive"

;[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Terminal Server\KeyboardType Mapping]


[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Ubpm]
"CriticalMaintenance_UsageDataReporting"=-

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Winlogon\Notifications\Components\GPClient]

;remove GPClient
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\Winlogon\Notifications\Configurations\Default]
"Logoff"="*,TermSrv,Profiles,SessionEnv,Wlansvc,Dot3svc"
"Logon"="SessionEnv,Profiles,Dot3svc,Wlansvc,TermSrv,AUInstallAgent,*"


[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\Diagtrack-Listener]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-Security]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-System\{152fbe4b-c7ad-4f68-bada-a4fcc1464f6c}]

[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-System\{1b562e86-b7aa-4131-badc-b6f3a001407e}]
"Enabled"=dword:00000000

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\NBSMBLOGGER]

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\SetupPlatformTel]
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\SetupPlatformTel]
"Start"=dword:00000000

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\Tpm]

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\WiFiSession\{1fc7fc44-07d5-59f7-8a3e-fc1ee708aa8e}]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\WiFiSession\{314DE49F-CE63-4779-BA2B-D616F6963A88}]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\WiFiSession\{60523747-6516-48B7-84B1-3264FA2CB359}]
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Autologger\WiFiSession\{ff7d986f-df89-5ec7-3fa5-cab4600d9491}]


[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Control\WMI\Security]
"437cf222-72fe-11d4-97f9-002048570337"=-
"11d8a17b-f2d8-4733-b41b-6f4959acd701"=-
"a0150dba-59bd-4b9e-8f56-2582e1cd8416"=-
"aea1b4fa-97d1-45f2-a64c-4d69fffd92c9"=-
"bd2f4252-5e1e-49fc-9a30-f3978ad89ee2"=-
"BDD865D1-D7C1-11d0-A501-00A0C9062910"=-
"c2e4133b-944b-4a21-af44-98a85f25e990"=-
"E46EEAD8-0C54-4489-9898-8FA79D059E0E"=-
"f27a3705-f597-4dca-92bf-323eef025d08"=-
"73E9C9DE-A148-41f7-B1DB-4DA051FDC327"=-
"C100BECC-D33A-4a4b-BF23-BBEF4663D017"=-
"1221948A-6332-4ac2-AA04-268AABCECE4F"=-
"225B9D64-47A9-41c8-81CD-69BC02652D87"=-
"36B58EA2-C461-4bb0-AC8E-952F59D251ED"=-
"391F3325-0BA3-4083-A861-CF4F6F97A527"=-
"41646815-7524-4bc0-904A-CD7D510EAC02"=-
"420512D9-0537-4c67-A779-84BA7B29CE9F"=-
"45755098-4291-43df-9720-B58642DD63DF"=
"46B122C0-3767-4069-916E-3A43702F05CE"=
"4AE27CD9-8DFA-4c37-A42C-B88A93E3E521"=
"53EF8D5F-36F3-4124-8B76-C6AD521A1021"=
"556BC0B0-0FB5-40f2-9255-B7D9A669DAEC"=
"58515BF3-2F59-4f37-B74F-85AEEC652AD6"=
"5C59FD61-E919-4687-84E2-7200ABE2209B"=-
"7A2C6C2B-E5A5-49ad-AD68-133089ACD74D"=-
"7BB02370-B8AE-4d29-88DE-76951D3245BA"=-
"84CA6FD6-B152-4e6a-8869-FDE5E37B6157"=
"8EAEF9D8-C053-49d3-9205-65C703C2ECC1"=-
"B35694DE-D323-49d2-ABB2-8139209AD150"=-
"B4D1C606-8682-4b7a-AC6B-D883D91555FB"=-
"C75258E9-BE79-4a48-A23D-EEB6F8FB940C"=-
"C827993C-6D1F-4194-9B5C-D7C0A5F1CFB7"=-
"D7931411-0376-4869-A491-8D679BFC004A"=-
"e67e1bdb-d130-4143-9eb2-8bee1899fd52"=-
"EA4D82BF-29DA-4e12-800A-E5437964462C"=-
"F022F413-3BF5-47ec-A942-33B81CF8E7FF"=-
"FA30C290-68DB-430a-AF76-91A2E1C49154"=-

[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Enum\ROOT\KDNIC]

;[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Services\dcpsvc]
;"Start"=dword:00000004

;Remote Access Auto Connection Driver
;System32\DRIVERS\rasacd.sys
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Services\RasAcd]
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Services\RasAcd\Parameters]

;X:\\Windows\\System32\\rasctrs.dll
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Services\RemoteAccess\Performance]
"Close"=-
"Collect"=-
"Library"=-
"Open"=-

;@%windir%\\system32\\diagtrack.dll
[HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules]
"Microsoft-Windows-Unified-Telemetry-Client"=-

;%SystemRoot%\System32\Perfctrs.dll
[-HKEY_LOCAL_MACHINE\Tmp_SYSTEM\ControlSet001\Services\Tcpip\Performance]
