Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'milw0rm' = '%WINDIR%\system\milw0rm.exe'
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\HaCkEd!!!.html
Вредоносные функции:
Создает и запускает на исполнение:
- '<Текущая директория>\cmd32.exe' regsetval sz "HKLM\Software\Microsoft\Internet Explorer\Main" "FullScreen" "yes"
- '<Текущая директория>\cmd32.exe' regsetval sz "HKLM\Software\Microsoft\Internet Explorer\Main" "Start Page" "file:///%WINDIR%/HaCkEd!!!.html"
- '<Текущая директория>\cmd32.exe' regsetval sz "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" "milw0rm" "%WINDIR%\system\milw0rm.exe"
Запускает на исполнение:
- '<SYSTEM32>\attrib.exe' -a -h -s -r %WINDIR%\system\svchost.exe
- '<SYSTEM32>\attrib.exe' -a -h -s -r %WINDIR%\system\explorer.exe
- '<SYSTEM32>\attrib.exe' -a -h -s -r %WINDIR%\system\net.exe
- '<SYSTEM32>\net1.exe' share $ /delete
- '<SYSTEM32>\net1.exe' user $ /del
- '<SYSTEM32>\attrib.exe' -a -h -s -r %WINDIR%\Prefetch\*.*
- '<SYSTEM32>\attrib.exe' +a +h +s +r %WINDIR%\system\milw0rm.exe
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\.~$callw0rm.cmd" "
- '<SYSTEM32>\schtasks.exe' /Delete /TN "KAV Scheduled Scan" /f
- '<SYSTEM32>\sc.exe' delete AVPDump
- '<SYSTEM32>\sc.exe' stop AVPDump
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Application Data\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Cookies\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Temp\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\History\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Cookies\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Temp\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\History\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\HaCkEd!!!.html
- %APPDATA%\Microsoft\SystemCertificates\My\CTLs\HaCkEd!!!.html
- %APPDATA%\Microsoft\SystemCertificates\My\CRLs\HaCkEd!!!.html
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\HaCkEd!!!.html
- %APPDATA%\Mozilla\Firefox\HaCkEd!!!.html
- %APPDATA%\Mozilla\Extensions\HaCkEd!!!.html
- %APPDATA%\Microsoft\Windows\Themes\HaCkEd!!!.html
- %APPDATA%\Microsoft\Windows\HaCkEd!!!.html
- %APPDATA%\Microsoft\SystemCertificates\HaCkEd!!!.html
- %APPDATA%\Microsoft\MMC\HaCkEd!!!.html
- %APPDATA%\Microsoft\SystemCertificates\My\HaCkEd!!!.html
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\HaCkEd!!!.html
- %APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\HaCkEd!!!.html
- %HOMEPATH%\Local Settings\Temporary Internet Files\HaCkEd!!!.html
- %TEMP%\HaCkEd!!!.html
- %HOMEPATH%\Local Settings\History\HaCkEd!!!.html
- <LS_APPDATA>\Mozilla\HaCkEd!!!.html
- <LS_APPDATA>\Microsoft\HaCkEd!!!.html
- <LS_APPDATA>\Identities\HaCkEd!!!.html
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\HaCkEd!!!.html
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\HaCkEd!!!.html
- %APPDATA%\Mozilla\Firefox\Profiles\HaCkEd!!!.html
- <LS_APPDATA>\HaCkEd!!!.html
- %HOMEPATH%\Favorites\Links\HaCkEd!!!.html
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\HaCkEd!!!.html
- %HOMEPATH%\Local Settings\HaCkEd!!!.html
- %HOMEPATH%\Favorites\HaCkEd!!!.html
- %HOMEPATH%\Desktop\HaCkEd!!!.html
- %HOMEPATH%\PrintHood\HaCkEd!!!.html
- %HOMEPATH%\NetHood\HaCkEd!!!.html
- %HOMEPATH%\My Documents\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\HaCkEd!!!.html
- %HOMEPATH%\Cookies\HaCkEd!!!.html
- %APPDATA%\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\HaCkEd!!!.html
- %APPDATA%\Microsoft\Address Book\HaCkEd!!!.html
- %APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\HaCkEd!!!.html
- %APPDATA%\Mozilla\HaCkEd!!!.html
- %APPDATA%\Microsoft\Media Player\HaCkEd!!!.html
- %APPDATA%\Microsoft\Internet Explorer\HaCkEd!!!.html
- %APPDATA%\Microsoft\Credentials\HaCkEd!!!.html
- %HOMEPATH%\Start Menu\HaCkEd!!!.html
- %HOMEPATH%\SendTo\HaCkEd!!!.html
- %HOMEPATH%\Recent\HaCkEd!!!.html
- %APPDATA%\Microsoft\HaCkEd!!!.html
- %APPDATA%\Identities\HaCkEd!!!.html
- %HOMEPATH%\Templates\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Documents\My Videos\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Documents\My Pictures\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Documents\My Music\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\HaCkEd!!!.html
- C:\Far2\HaCkEd!!!.html
- C:\Documents and Settings\HaCkEd!!!.html
- <Текущая директория>\HaCkEd!!!.html
- C:\RECYCLER\HaCkEd!!!.html
- %PROGRAM_FILES%\HaCkEd!!!.html
- <Служебный элемент>
- <Текущая директория>\.~$milw0rm.exe
- <Текущая директория>\cmd32.exe
- %TEMP%\1.tmp\.~$callw0rm.cmd
- %WINDIR%\HaCkEd!!!.html
- %WINDIR%\system\milw0rm.exe
- <Текущая директория>\milw0rm.html
- %ALLUSERSPROFILE%\DRM\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Documents\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Desktop\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Templates\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Start Menu\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Favorites\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\HaCkEd!!!.html
- C:\Documents and Settings\Default User\HaCkEd!!!.html
- %ALLUSERSPROFILE%\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Application Data\HaCkEd!!!.html
- %HOMEPATH%\HaCkEd!!!.html
- C:\Documents and Settings\NetworkService\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Temp\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\History\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Start Menu\Programs\HaCkEd!!!.html
- C:\Documents and Settings\LocalService\Application Data\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Application Data\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Favorites\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Desktop\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Cookies\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Start Menu\Programs\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HaCkEd!!!.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Templates\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Start Menu\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HaCkEd!!!.html
- C:\Documents and Settings\Default User\NetHood\HaCkEd!!!.html
- C:\Documents and Settings\Default User\My Documents\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Local Settings\HaCkEd!!!.html
- C:\Documents and Settings\Default User\SendTo\HaCkEd!!!.html
- C:\Documents and Settings\Default User\Recent\HaCkEd!!!.html
- C:\Documents and Settings\Default User\PrintHood\HaCkEd!!!.html
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\system\milw0rm.exe
Удаляет следующие файлы:
- %WINDIR%\Prefetch\SERVICEMODELREG.EXE-3848AC09.pf
- %WINDIR%\Prefetch\SERVICES.EXE-2F433351.pf
- %WINDIR%\Prefetch\SETUP.EXE-015E7381.pf
- %WINDIR%\Prefetch\SERVICEMODELREG.EXE-1FB5DD06.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-49F747DB.pf
- %WINDIR%\Prefetch\RUNONCE.EXE-2803F297.pf
- %WINDIR%\Prefetch\SCOOPYNG.EXE-1E3B99FD.pf
- %WINDIR%\Prefetch\SETUP.EXE-0FFAB653.pf
- %WINDIR%\Prefetch\SETUP_WM.EXE-3135CBD7.pf
- %WINDIR%\Prefetch\SHMGRATE.EXE-1BA69E68.pf
- %WINDIR%\Prefetch\SL1.TMP-04C43349.pf
- %WINDIR%\Prefetch\SETUP50.EXE-362FF7C9.pf
- %WINDIR%\Prefetch\SETUP.EXE-183299E5.pf
- %WINDIR%\Prefetch\SETUP.EXE-1BF5B58E.pf
- %WINDIR%\Prefetch\SETUP.EXE-314FAC7C.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-1BC69D2D.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-2576181F.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-286A7F8C.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-1831A4F3.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-12E27DD0.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-147710F4.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-169CA248.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-29373198.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-4176E9B5.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-4499C56E.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-470F11BD.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-31EBBE5F.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-2AF77CC9.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-2C7B5C4A.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-2F26E69F.pf
- %WINDIR%\Prefetch\SL38.TMP-141C07C8.pf
- %WINDIR%\Prefetch\VCREDI~3.EXE-0730BA06.pf
- %WINDIR%\Prefetch\VS7.1SP1-KB9322981102-X86-ENU-356F70C0.pf
- %WINDIR%\Prefetch\WFSERVICESREG.EXE-063492A2.pf
- %WINDIR%\Prefetch\VCREDI~1.EXE-33033670.pf
- %WINDIR%\Prefetch\VCREDIST_X86_2008.EXE-0322FB7F.pf
- %WINDIR%\Prefetch\VCREDIST_X86_2010.EXE-24F154F5.pf
- %WINDIR%\Prefetch\VCREDIST_X86_2010SP1.EXE-2DD9A199.pf
- %WINDIR%\Prefetch\WIC_X86_ENU.EXE-0A240D86.pf
- %WINDIR%\Prefetch\WUAUCLT.EXE-399A8E72.pf
- %WINDIR%\Prefetch\XPSEPSC-X86-EN-US.EXE-13D81584.pf
- %WINDIR%\Prefetch\XPSEPSC-X86-EN-US.EXE-1D9A5DDC.pf
- %WINDIR%\Prefetch\WSCNTFY.EXE-1B24F5EB.pf
- %WINDIR%\Prefetch\WMIADAP.EXE-2DF425B2.pf
- %WINDIR%\Prefetch\WMIPRVSE.EXE-28F301A9.pf
- %WINDIR%\Prefetch\WMPLAYER.EXE-18DDEF9D.pf
- %WINDIR%\Prefetch\TOURSTART.EXE-0D0140ED.pf
- %WINDIR%\Prefetch\UNLODCTR.EXE-37313252.pf
- %WINDIR%\Prefetch\UNREGMP2.EXE-07CACB61.pf
- %WINDIR%\Prefetch\TASKMGR.EXE-20256C55.pf
- %WINDIR%\Prefetch\SPOOLSV.EXE-282F76A7.pf
- %WINDIR%\Prefetch\SPUPDSVC.EXE-21B36524.pf
- %WINDIR%\Prefetch\SVCHOST.EXE-3530F672.pf
- %WINDIR%\Prefetch\UPDATE.EXE-0B22B468.pf
- %WINDIR%\Prefetch\VCREDIST.EXE-3810E24C.pf
- %WINDIR%\Prefetch\VCREDIST_X86_2005.EXE-1A2586B8.pf
- %WINDIR%\Prefetch\VCREDIST_X86_2005SP1.EXE-005B71E6.pf
- %WINDIR%\Prefetch\VC6REDISTSETUP_ENU.EXE-0D8EC880.pf
- %WINDIR%\Prefetch\UPDATE.EXE-15191106.pf
- %WINDIR%\Prefetch\UPDATE.EXE-32EB78F6.pf
- %WINDIR%\Prefetch\USERINIT.EXE-30B18140.pf
- %WINDIR%\Prefetch\DOTNETFX35SETUP.EXE-39FE1058.pf
- %WINDIR%\Prefetch\DOTNETFX40_FULL_X86_X64.EXE-2F42557F.pf
- %WINDIR%\Prefetch\DOTNETREDIST.EXE-2C5CB08D.pf
- %WINDIR%\Prefetch\DOTNETFX35.EXE-0101DD70.pf
- %WINDIR%\Prefetch\DOTNETFX.EXE-2AC9C3A4.pf
- %WINDIR%\Prefetch\DOTNETFX.EXE-2FD4C451.pf
- %WINDIR%\Prefetch\DOTNETFX3.EXE-35065F74.pf
- %WINDIR%\Prefetch\EXPLORER.EXE-082F38A9.pf
- %WINDIR%\Prefetch\IEXPLORE.EXE-27122324.pf
- %WINDIR%\Prefetch\IMAPI.EXE-0BF740A4.pf
- %WINDIR%\Prefetch\INSTALL.EXE-372327E4.pf
- %WINDIR%\Prefetch\IE4UINIT.EXE-169A5A39.pf
- %WINDIR%\Prefetch\FAR.EXE-13A195F9.pf
- %WINDIR%\Prefetch\FIREFOX.EXE-030B768A.pf
- %WINDIR%\Prefetch\ICWCONN1.EXE-24884676.pf
- %WINDIR%\Prefetch\CALC.EXE-02CD573A.pf
- %WINDIR%\Prefetch\CLWIREG.EXE-2A4BC2FD.pf
- %WINDIR%\Prefetch\CMD.EXE-087B4001.pf
- %WINDIR%\Prefetch\ASPNET_REGIIS.EXE-38397C30.pf
- %WINDIR%\Prefetch\ALG.EXE-0F138680.pf
- %WINDIR%\Prefetch\ASPNET_REGIIS.EXE-009D6E80.pf
- %WINDIR%\Prefetch\ASPNET_REGIIS.EXE-057C90FA.pf
- %WINDIR%\Prefetch\CONTROL.EXE-013DBFB5.pf
- %WINDIR%\Prefetch\CVTRES.EXE-2329DCD5.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-5353C76C.pf
- %WINDIR%\Prefetch\DOTNETFX.EXE-1747AF91.pf
- %WINDIR%\Prefetch\CTFMON.EXE-0E17969B.pf
- %WINDIR%\Prefetch\CSC.EXE-01730C27.pf
- %WINDIR%\Prefetch\CSCRIPT.EXE-1C26180C.pf
- %WINDIR%\Prefetch\CSRSS.EXE-12B63473.pf
- %WINDIR%\Prefetch\INSTALL.EXE-37B819BB.pf
- %WINDIR%\Prefetch\PERFORMANCECOUNTERINSTALLER.E-334D54EC.pf
- %WINDIR%\Prefetch\PRESETUP.EXE-1C8BD573.pf
- %WINDIR%\Prefetch\PRINTFILTERPIPELINESVC.EXE-0F2B9E77.pf
- %WINDIR%\Prefetch\NTOSBOOT-B00DFAAD.pf
- %WINDIR%\Prefetch\NGEN.EXE-171CDCC6.pf
- %WINDIR%\Prefetch\NGEN.EXE-1F9EA69F.pf
- %WINDIR%\Prefetch\NGEN.EXE-38021CCC.pf
- %WINDIR%\Prefetch\PRINTFILTERPIPELINESVC.EXE-31AE7114.pf
- %WINDIR%\Prefetch\REGTLIB.EXE-0CCB81E6.pf
- %WINDIR%\Prefetch\REGTLIBV12.EXE-0E2FA54B.pf
- %WINDIR%\Prefetch\REGTLIBV12.EXE-35B5D8AD.pf
- %WINDIR%\Prefetch\REGSVR32.EXE-25EEFE2F.pf
- %WINDIR%\Prefetch\REGEDIT.EXE-1B606482.pf
- %WINDIR%\Prefetch\REGSVCS.EXE-077D24C2.pf
- %WINDIR%\Prefetch\REGSVCS.EXE-11A17120.pf
- %WINDIR%\Prefetch\MIGPOLWIN.EXE-1EFB7D70.pf
- %WINDIR%\Prefetch\MMC.EXE-39071BCC.pf
- %WINDIR%\Prefetch\MOFCOMP.EXE-01718E95.pf
- %WINDIR%\Prefetch\LSASS.EXE-20DB6D1B.pf
- %WINDIR%\Prefetch\LODCTR.EXE-1009C3B4.pf
- %WINDIR%\Prefetch\LOGON.SCR-151EFAEA.pf
- %WINDIR%\Prefetch\LOGONUI.EXE-0AF22957.pf
- %WINDIR%\Prefetch\MSCONFIG.EXE-35E4DAE9.pf
- %WINDIR%\Prefetch\MSIMN.EXE-38BA891D.pf
- %WINDIR%\Prefetch\MSMSGS.EXE-2B6052DE.pf
- %WINDIR%\Prefetch\MSOOBE.EXE-30411B02.pf
- %WINDIR%\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf
- %WINDIR%\Prefetch\MSCORSVW.EXE-1366B4F5.pf
- %WINDIR%\Prefetch\MSCORSVW.EXE-1BF30400.pf
- %WINDIR%\Prefetch\MSDTC.EXE-0E6E4AF7.pf
