CreateRestorePoint:
CloseProcesses:
cmd: reg load HKLM\COMPONENTS %systemroot%\System32\config\COMPONENTS
DeleteValue: HKLM\COMPONENTS\CanonicalData\Deployments\000a6db1a80..bd3c88175cd_31bf3856ad364e35_11.2.9600.18816_8083e7a2781b458d|p!CBS_package_154_for_kb4041681~31bf3856ad364e35~amd64~~6.1.1.0.40_6088654ba975d942
DeleteValue: HKLM\COMPONENTS\CanonicalData\Deployments\000a6db1a80..bd3c88175cd_31bf3856ad364e35_11.2.9600.18816_8083e7a2781b458d|p!
...