Registry Persistence Detection

Analyze Windows registry autorun entries to identify malware persistence. Write a function that examines Run key entries, flags suspicious ones based on path and naming anomalies, and returns the suspicious entry name with a suspicion score (0-100).

Scoring Rules (0-100 per entry):

• Path in Users\Public: +40 points
• Executable name matches a system process (svchost, csrss, lsass, services, winlogon): +30 points
• Entry name doesn't appear in the executable path: +20 points
• Path in ProgramData but not under Microsoft: +10 points

Output Format: One line per suspicious entry (score > 0), sorted by score descending:

entryName: score