@Dennis do you have to know very specific registry key? Since it changes even when you install something new. From the look of the registry tables from osquery.io, I see that it can see timestamp of the most recent registry wire. Is it possible to see what it was before the recent registry write occured?