

HKEY_LOCAL_MACHINE

[SOFTWARE\rising]
   [SOFTWARE\rising\disable]
   [SOFTWARE\rising\ESM]
   |___ֵ:LastUseMode            ֵ:REG_DWORD                   ֵ:1
   [SOFTWARE\rising\MiniStore]
   |___ֵ:Vol.c.LastFile         ֵ:REG_BINARY                  ֵ:
   |___ֵ:Dir.WinSXS.LastFile    ֵ:REG_BINARY                  ֵ:
   |___ֵ:Vol.d.LastFile         ֵ:REG_BINARY                  ֵ:
   |___ֵ:Vol.e.LastFile         ֵ:REG_BINARY                  ֵ:
   |___ֵ:Dir.System32.LastFile   ֵ:REG_BINARY                  ֵ:
   |___ֵ:Dir.Program.LastFile   ֵ:REG_BINARY                  ֵ:
   |___ֵ:Vol.f.LastFile         ֵ:REG_BINARY                  ֵ:
   [SOFTWARE\rising\perflog]
   [SOFTWARE\rising\REC]
   |___ֵ:InstallPath            ֵ:REG_SZ                      ֵ:E:\\Rising\REC
   |___ֵ:DataPath               ֵ:REG_SZ                      ֵ:C:\ProgramData\Rising\REC
   |___ֵ:libver13               ֵ:REG_SZ                      ֵ:35.0221.0001
   |___ֵ:libtime13              ֵ:REG_SZ                      ֵ:2023-02-21 02:53:22
   |___ֵ:Version                ֵ:REG_SZ                      ֵ:3.0.50.35
   |___ֵ:UpdateTime             ֵ:REG_SZ                      ֵ:2023-02-17 10:58:34
   |___ֵ:autotest               ֵ:REG_DWORD                   ֵ:0
   |___ֵ:LastUseMode            ֵ:REG_DWORD                   ֵ:1
   [SOFTWARE\rising\rpt]
   |___ֵ:bsi                    ֵ:REG_DWORD                   ֵ:1
   |___ֵ:hrpv                   ֵ:REG_DWORD                   ֵ:1
   |___ֵ:nsrp                   ֵ:REG_DWORD                   ֵ:1
   [SOFTWARE\rising\rscommon]
   |___ֵ:datapath               ֵ:REG_SZ                      ֵ:C:\ProgramData\Rising\common


MoveFileEx Reg : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations

\??\C:\Windows\Temp\a3239db2-2ef7-4cb9-9303-5cdcb28d7bd4.tmp
