\Registry\Machine\Software\Windows_NT_File_System_Internals\SFilter
    MajorVersionNumber = REG_DWORD 0x0
    MinorVersionNumber = REG_DWORD 0x1

\Registry\Machine\System\CurrentControlSet\Services\SFilter
    Type = REG_DWORD 0x00000002
    Start = REG_DWORD 0x00000000
    ErrorControl = REG_DWORD 0x00000001
    Group = File System
    ImagePath = REG_EXPAND_SZ \SystemRoot\System32\drivers\sfilter.sys

