Trojan.KillFiles.60751

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\system.ini
%WINDIR%\win.ini

Изменяет следующие исполняемые системные файлы:

<SYSTEM32>\dllcache\lpr.exe
<SYSTEM32>\dllcache\lsass.exe
<SYSTEM32>\dllcache\makecab.exe
<SYSTEM32>\dllcache\magnify.exe
<SYSTEM32>\dllcache\locator.exe
<SYSTEM32>\dllcache\lnkstub.exe
<SYSTEM32>\dllcache\lpq.exe
<SYSTEM32>\dllcache\logonui.exe
<SYSTEM32>\dllcache\mcd.sys
<SYSTEM32>\dllcache\migwiz_a.exe
<SYSTEM32>\dllcache\migload.exe
<SYSTEM32>\dllcache\mmc.exe
<SYSTEM32>\dllcache\migrate.exe
<SYSTEM32>\dllcache\migwiz.exe
<SYSTEM32>\dllcache\mga.sys
<SYSTEM32>\dllcache\migregdb.exe
<SYSTEM32>\dllcache\migisol.exe
<SYSTEM32>\dllcache\ipsec6.exe
<SYSTEM32>\dllcache\ipsec.sys
<SYSTEM32>\dllcache\isignup.exe
<SYSTEM32>\dllcache\ipxroute.exe
<SYSTEM32>\dllcache\ipfltdrv.sys
<SYSTEM32>\dllcache\ipconfig.exe
<SYSTEM32>\dllcache\ipnat.sys
<SYSTEM32>\dllcache\ipinip.sys
<SYSTEM32>\dllcache\irenum.sys
<SYSTEM32>\dllcache\lights.exe
<SYSTEM32>\dllcache\logman.exe
<SYSTEM32>\dllcache\logagent.exe
<SYSTEM32>\dllcache\lodctr.exe
<SYSTEM32>\dllcache\ksecdd.sys
<SYSTEM32>\dllcache\ipv6.exe
<SYSTEM32>\dllcache\logoff.exe
<SYSTEM32>\dllcache\label.exe
<SYSTEM32>\dllcache\msgpc.sys
<SYSTEM32>\dllcache\mshearts.exe
<SYSTEM32>\dllcache\msimn.exe
<SYSTEM32>\dllcache\msiexec.exe
<SYSTEM32>\dllcache\msfs.sys
<SYSTEM32>\dllcache\msdtc.exe
<SYSTEM32>\dllcache\mshta.exe
<SYSTEM32>\dllcache\msg.exe
<SYSTEM32>\dllcache\msiregmv.exe
<SYSTEM32>\dllcache\muisetup.exe
<SYSTEM32>\dllcache\msswchx.exe
<SYSTEM32>\dllcache\mup.sys
<SYSTEM32>\dllcache\mstsc.exe
<SYSTEM32>\dllcache\msoobe.exe
<SYSTEM32>\dllcache\msinfo32.exe
<SYSTEM32>\dllcache\mstinit.exe
<SYSTEM32>\dllcache\mspaint.exe
<SYSTEM32>\dllcache\mountvol.exe
<SYSTEM32>\dllcache\mountmgr.sys
<SYSTEM32>\dllcache\mplayer2.exe
<SYSTEM32>\dllcache\moviemk.exe
<SYSTEM32>\dllcache\mobsync.exe
<SYSTEM32>\dllcache\mnmdd.sys
<SYSTEM32>\dllcache\mofcomp.exe
<SYSTEM32>\dllcache\mnmsrvc.exe
<SYSTEM32>\dllcache\mplay32.exe
<SYSTEM32>\dllcache\mrxdav.sys
<SYSTEM32>\dllcache\msconfig.exe
<SYSTEM32>\dllcache\mrinfo.exe
<SYSTEM32>\dllcache\mqtgsvc.exe
<SYSTEM32>\dllcache\mqac.sys
<SYSTEM32>\dllcache\mqbkup.exe
<SYSTEM32>\dllcache\mqsvc.exe
<SYSTEM32>\dllcache\mpnotify.exe
<SYSTEM32>\dllcache\fxsclnt.exe
<SYSTEM32>\dllcache\fpcount.exe
<SYSTEM32>\dllcache\fxscover.exe
<SYSTEM32>\dllcache\fs_rec.sys
<SYSTEM32>\dllcache\fpadmcgi.exe
<SYSTEM32>\dllcache\fpremadm.exe
<SYSTEM32>\dllcache\fsutil.exe
<SYSTEM32>\dllcache\freecell.exe
<SYSTEM32>\dllcache\ftp.exe
<SYSTEM32>\dllcache\grpconv.exe
<SYSTEM32>\dllcache\gprslt.exe
<SYSTEM32>\dllcache\helpctr.exe
<SYSTEM32>\dllcache\help.exe
<SYSTEM32>\dllcache\fxssvc.exe
<SYSTEM32>\dllcache\fxssend.exe
<SYSTEM32>\dllcache\gpupdate.exe
<SYSTEM32>\dllcache\getmac.exe
<SYSTEM32>\dllcache\finger.exe
<SYSTEM32>\dllcache\extrac32.exe
<SYSTEM32>\dllcache\fixmapi.exe
<SYSTEM32>\dllcache\find.exe
<SYSTEM32>\dllcache\EXCH_regtrace.exe
<SYSTEM32>\dllcache\expand.exe
<SYSTEM32>\dllcache\fastfat.sys
<SYSTEM32>\dllcache\fc.exe
<SYSTEM32>\dllcache\findstr.exe
<SYSTEM32>\dllcache\forcedos.exe
<SYSTEM32>\dllcache\fontview.exe
<SYSTEM32>\dllcache\fp98sadm.exe
<SYSTEM32>\dllcache\fp98swin.exe
<SYSTEM32>\dllcache\flattemp.exe
<SYSTEM32>\dllcache\fips.sys
<SYSTEM32>\dllcache\fltmgr.sys
<SYSTEM32>\dllcache\fltmc.exe
<SYSTEM32>\dllcache\imjpinst.exe
<SYSTEM32>\dllcache\imjpdct.exe
<SYSTEM32>\dllcache\imjpmig.exe
<SYSTEM32>\dllcache\imjprw.exe
<SYSTEM32>\dllcache\imepadsv.exe
<SYSTEM32>\dllcache\iissync.exe
<SYSTEM32>\dllcache\imjpdadm.exe
<SYSTEM32>\dllcache\imapi.exe
<SYSTEM32>\dllcache\imjpdsvr.exe
<SYSTEM32>\dllcache\inetwiz.exe
<SYSTEM32>\dllcache\inetmgr.exe
<SYSTEM32>\dllcache\ip6fw.sys
<SYSTEM32>\dllcache\imscinst.exe
<SYSTEM32>\dllcache\imjpuex.exe
<SYSTEM32>\dllcache\imjputy.exe
<SYSTEM32>\dllcache\inetin51.exe
<SYSTEM32>\dllcache\imkrinst.exe
<SYSTEM32>\dllcache\hrtzzm.exe
<SYSTEM32>\dllcache\helpsvc.exe
<SYSTEM32>\dllcache\hscupd.exe
<SYSTEM32>\dllcache\icwconn2.exe
<SYSTEM32>\dllcache\hh.exe
<SYSTEM32>\dllcache\helphost.exe
<SYSTEM32>\dllcache\icwconn1.exe
<SYSTEM32>\dllcache\hostname.exe
<SYSTEM32>\dllcache\icwrmind.exe
<SYSTEM32>\dllcache\iisrstas.exe
<SYSTEM32>\dllcache\iexplore.exe
<SYSTEM32>\dllcache\imekrmig.exe
<SYSTEM32>\dllcache\iisreset.exe
<SYSTEM32>\dllcache\ie4uinit.exe
<SYSTEM32>\dllcache\icwtutor.exe
<SYSTEM32>\dllcache\iedw.exe
<SYSTEM32>\dllcache\iexpress.exe
<SYSTEM32>\dllcache\mtstocom.exe
<SYSTEM32>\dllcache\regwiz.exe
<SYSTEM32>\dllcache\rexec.exe
<SYSTEM32>\dllcache\reset.exe
<SYSTEM32>\dllcache\replace.exe
<SYSTEM32>\dllcache\register.exe
<SYSTEM32>\dllcache\rdpwd.sys
<SYSTEM32>\dllcache\relog.exe
<SYSTEM32>\dllcache\regsvr32.exe
<SYSTEM32>\dllcache\rndismp.sys
<SYSTEM32>\dllcache\rsmsink.exe
<SYSTEM32>\dllcache\rmcast.sys
<SYSTEM32>\dllcache\rsopprov.exe
<SYSTEM32>\dllcache\rsnotify.exe
<SYSTEM32>\dllcache\routemon.exe
<SYSTEM32>\dllcache\rootmdm.sys
<SYSTEM32>\dllcache\route.exe
<SYSTEM32>\dllcache\rsm.exe
<SYSTEM32>\dllcache\raspptp.sys
<SYSTEM32>\dllcache\rcimlby.exe
<SYSTEM32>\dllcache\rdsaddin.exe
<SYSTEM32>\dllcache\rcp.exe
<SYSTEM32>\dllcache\raspppoe.sys
<SYSTEM32>\dllcache\rasphone.exe
<SYSTEM32>\dllcache\raspti.sys
<SYSTEM32>\dllcache\rawwan.sys
<SYSTEM32>\dllcache\rdpcdd.sys
<SYSTEM32>\dllcache\rdpclip.exe
<SYSTEM32>\dllcache\regedit.exe
<SYSTEM32>\dllcache\reg.exe
<SYSTEM32>\dllcache\regini.exe
<SYSTEM32>\dllcache\rdshost.exe
<SYSTEM32>\dllcache\rdbss.sys
<SYSTEM32>\dllcache\recover.exe
<SYSTEM32>\dllcache\regedt32.exe
<SYSTEM32>\dllcache\sessmgr.exe
<SYSTEM32>\dllcache\setup_wm.exe
<SYSTEM32>\dllcache\sethc.exe
<SYSTEM32>\dllcache\setup.exe
<SYSTEM32>\dllcache\secedit.exe
<SYSTEM32>\dllcache\sfc.exe
<SYSTEM32>\dllcache\setup50.exe
<SYSTEM32>\dllcache\services.exe
<SYSTEM32>\dllcache\shadow.exe
<SYSTEM32>\dllcache\shmgrate.exe
<SYSTEM32>\dllcache\skeys.exe
<SYSTEM32>\dllcache\smbinst.exe
<SYSTEM32>\dllcache\shtml.exe
<SYSTEM32>\dllcache\shutdown.exe
<SYSTEM32>\dllcache\shrpubw.exe
<SYSTEM32>\dllcache\smclib.sys
<SYSTEM32>\dllcache\shvlzm.exe
<SYSTEM32>\dllcache\rtcshare.exe
<SYSTEM32>\dllcache\runas.exe
<SYSTEM32>\dllcache\rundll32.exe
<SYSTEM32>\dllcache\runonce.exe
<SYSTEM32>\dllcache\rsh.exe
<SYSTEM32>\dllcache\rsmui.exe
<SYSTEM32>\dllcache\rsvp.exe
<SYSTEM32>\dllcache\rstrui.exe
<SYSTEM32>\dllcache\rvsezm.exe
<SYSTEM32>\dllcache\savedump.exe
<SYSTEM32>\dllcache\sapisvr.exe
<SYSTEM32>\dllcache\scrcons.exe
<SYSTEM32>\dllcache\sc.exe
<SYSTEM32>\dllcache\sctasks.exe
<SYSTEM32>\dllcache\rwinsta.exe
<SYSTEM32>\dllcache\sdbinst.exe
<SYSTEM32>\dllcache\scardsvr.exe
<SYSTEM32>\dllcache\ntfs.sys
<SYSTEM32>\dllcache\nslookup.exe
<SYSTEM32>\dllcache\ntsd.exe
<SYSTEM32>\dllcache\ntvdm.exe
<SYSTEM32>\dllcache\notiflag.exe
<SYSTEM32>\dllcache\nmnt.sys
<SYSTEM32>\dllcache\ntbackup.exe
<SYSTEM32>\dllcache\nppagent.exe
<SYSTEM32>\dllcache\null.sys
<SYSTEM32>\dllcache\packager.exe
<SYSTEM32>\dllcache\nwlnkspx.sys
<SYSTEM32>\dllcache\nwrdr.sys
<SYSTEM32>\dllcache\nwscript.exe
<SYSTEM32>\dllcache\nwlnkfwd.sys
<SYSTEM32>\dllcache\nwlnkflt.sys
<SYSTEM32>\dllcache\nwlnknb.sys
<SYSTEM32>\dllcache\nwlnkipx.sys
<SYSTEM32>\dllcache\net1.exe
<SYSTEM32>\dllcache\nddeapir.exe
<SYSTEM32>\dllcache\netbios.sys
<SYSTEM32>\dllcache\ndiswan.sys
<SYSTEM32>\dllcache\nbtstat.exe
<SYSTEM32>\dllcache\narrator.exe
<SYSTEM32>\dllcache\ndis.sys
<SYSTEM32>\dllcache\ndistapi.sys
<SYSTEM32>\dllcache\net.exe
<SYSTEM32>\dllcache\notepad.exe
<SYSTEM32>\dllcache\netsh.exe
<SYSTEM32>\dllcache\npfs.sys
<SYSTEM32>\dllcache\netstat.exe
<SYSTEM32>\dllcache\ndproxy.sys
<SYSTEM32>\dllcache\netbt.sys
<SYSTEM32>\dllcache\netdde.exe
<SYSTEM32>\dllcache\netsetup.exe
<SYSTEM32>\dllcache\ptilink.sys
<SYSTEM32>\dllcache\qappsrv.exe
<SYSTEM32>\dllcache\quser.exe
<SYSTEM32>\dllcache\proxycfg.exe
<SYSTEM32>\dllcache\progman.exe
<SYSTEM32>\dllcache\print.exe
<SYSTEM32>\dllcache\psched.sys
<SYSTEM32>\dllcache\proquota.exe
<SYSTEM32>\dllcache\query.exe
<SYSTEM32>\dllcache\ramdisk.sys
<SYSTEM32>\dllcache\qwinsta.exe
<SYSTEM32>\dllcache\rasl2tp.sys
<SYSTEM32>\dllcache\rasacd.sys
<SYSTEM32>\dllcache\qprocess.exe
<SYSTEM32>\dllcache\printfilterpipelinesvc.exe
<SYSTEM32>\dllcache\rasdial.exe
<SYSTEM32>\dllcache\rasautou.exe
<SYSTEM32>\dllcache\parvdm.sys
<SYSTEM32>\dllcache\oobebaln.exe
<SYSTEM32>\dllcache\osuninst.exe
<SYSTEM32>\dllcache\osk.exe
<SYSTEM32>\dllcache\odbcconf.exe
<SYSTEM32>\dllcache\oemig50.exe
<SYSTEM32>\dllcache\opnfiles.exe
<SYSTEM32>\dllcache\odbcad32.exe
<SYSTEM32>\dllcache\perfmon.exe
<SYSTEM32>\dllcache\ping6.exe
<SYSTEM32>\dllcache\pentnt.exe
<SYSTEM32>\dllcache\powercfg.exe
<SYSTEM32>\dllcache\pintlphr.exe
<SYSTEM32>\dllcache\ping.exe
<SYSTEM32>\dllcache\pathping.exe
<SYSTEM32>\dllcache\partmgr.sys
<SYSTEM32>\dllcache\pinball.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe
%WINDIR%\NOTEPAD.EXE
%WINDIR%\mui\muisetup.exe
%WINDIR%\pchealth\helpctr\binaries\HscUpd.exe
%WINDIR%\pchealth\helpctr\binaries\HelpHost.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
%WINDIR%\Microsoft.NET\NETFXRepair.exe
%WINDIR%\msagent\agentsvr.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
<SYSTEM32>\autofmt.exe
<SYSTEM32>\autoconv.exe
<SYSTEM32>\blastcln.exe
<SYSTEM32>\autolfn.exe
<SYSTEM32>\auditusr.exe
<SYSTEM32>\asr_fmt.exe
<SYSTEM32>\autochk.exe
<SYSTEM32>\at.exe
<SYSTEM32>\bootcfg.exe
<SYSTEM32>\charmap.exe
<SYSTEM32>\chkdsk.exe
<SYSTEM32>\cisvc.exe
<SYSTEM32>\chkntfs.exe
<SYSTEM32>\bootvrfy.exe
<SYSTEM32>\bootok.exe
<SYSTEM32>\cacls.exe
<SYSTEM32>\calc.exe
%WINDIR%\regedit.exe
%WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe
%WINDIR%\sfk.exe
%WINDIR%\sleep.exe
%WINDIR%\pchealth\helpctr\binaries\HelpSvc.exe
%WINDIR%\pchealth\helpctr\binaries\notiflag.exe
%WINDIR%\pchealth\helpctr\binaries\msconfig.exe
%WINDIR%\pchealth\helpctr\binaries\HelpCtr.exe
<SYSTEM32>\actmovie.exe
<SYSTEM32>\attrib.exe
<SYSTEM32>\asr_ldm.exe
<SYSTEM32>\atmadm.exe
<SYSTEM32>\asr_pfu.exe
<SYSTEM32>\accwiz.exe
<SYSTEM32>\ahui.exe
<SYSTEM32>\arp.exe
%WINDIR%\system\WINSPOOL.DRV
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\NETFXSBS10.exe
%WINDIR%\inf\unregmp2.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInUtil.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\csc.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
<SYSTEM32>\cidaemon.exe
<SYSTEM32>\dllcache\control.exe
<SYSTEM32>\dllcache\convlog.exe
<SYSTEM32>\dllcache\cprofile.exe
<SYSTEM32>\dllcache\convert.exe
<SYSTEM32>\dllcache\comrepl.exe
<SYSTEM32>\dllcache\comrereg.exe
<SYSTEM32>\dllcache\conime.exe
<SYSTEM32>\dllcache\conf.exe
<SYSTEM32>\dllcache\cplexe.exe
<SYSTEM32>\dllcache\dcomcnfg.exe
<SYSTEM32>\dllcache\davcdata.exe
<SYSTEM32>\dllcache\dfrgfat.exe
<SYSTEM32>\dllcache\ddeshare.exe
<SYSTEM32>\dllcache\ctfmon.exe
<SYSTEM32>\dllcache\cscript.exe
<SYSTEM32>\dllcache\defrag.exe
<SYSTEM32>\dllcache\csrss.exe
<SYSTEM32>\dllcache\classpnp.sys
<SYSTEM32>\dllcache\cidaemon.exe
<SYSTEM32>\dllcache\cintsetp.exe
<SYSTEM32>\dllcache\ckcnv.exe
<SYSTEM32>\dllcache\chkntfs.exe
<SYSTEM32>\dllcache\chkrzm.exe
<SYSTEM32>\dllcache\cisvc.exe
<SYSTEM32>\dllcache\cipher.exe
<SYSTEM32>\dllcache\cleanmgr.exe
<SYSTEM32>\dllcache\compact.exe
<SYSTEM32>\dllcache\cmstp.exe
<SYSTEM32>\dllcache\clipsrv.exe
<SYSTEM32>\dllcache\cmdl32.exe
<SYSTEM32>\dllcache\cmd.exe
<SYSTEM32>\dllcache\clipbrd.exe
<SYSTEM32>\dllcache\cmmon32.exe
<SYSTEM32>\dllcache\comp.exe
<SYSTEM32>\dllcache\dxgthk.sys
<SYSTEM32>\dllcache\dwwin.exe
<SYSTEM32>\dllcache\evcreate.exe
<SYSTEM32>\dllcache\esentutl.exe
<SYSTEM32>\dllcache\drvqry.exe
<SYSTEM32>\dllcache\drwtsn32.exe
<SYSTEM32>\dllcache\dvdupgrd.exe
<SYSTEM32>\dllcache\dumprep.exe
<SYSTEM32>\dllcache\dxapi.sys
<SYSTEM32>\dllcache\evtrig.exe
<SYSTEM32>\dllcache\evntcmd.exe
<SYSTEM32>\dllcache\explorer.exe
<SYSTEM32>\dllcache\evntwin.exe
<SYSTEM32>\dllcache\eudcedit.exe
<SYSTEM32>\dllcache\dxdiag.exe
<SYSTEM32>\dllcache\et4000.sys
<SYSTEM32>\dllcache\eventvwr.exe
<SYSTEM32>\dllcache\diskperf.exe
<SYSTEM32>\dllcache\diskpart.exe
<SYSTEM32>\dllcache\dllhost.exe
<SYSTEM32>\dllcache\dllhst3g.exe
<SYSTEM32>\dllcache\dialer.exe
<SYSTEM32>\dllcache\dfrgntfs.exe
<SYSTEM32>\dllcache\diskdump.sys
<SYSTEM32>\dllcache\diantz.exe
<SYSTEM32>\dllcache\dmio.sys
<SYSTEM32>\dllcache\dplaysvr.exe
<SYSTEM32>\dllcache\dmremote.exe
<SYSTEM32>\dllcache\dpvsetup.exe
<SYSTEM32>\dllcache\dpnsvr.exe
<SYSTEM32>\dllcache\doskey.exe
<SYSTEM32>\dllcache\dmboot.sys
<SYSTEM32>\dllcache\dmload.sys
<SYSTEM32>\dllcache\dmadmin.exe
<SYSTEM32>\dllcache\actmovie.exe
<SYSTEM32>\diantz.exe
<SYSTEM32>\dllcache\afd.sys
<SYSTEM32>\dllcache\accwiz.exe
<SYSTEM32>\defrag.exe
<SYSTEM32>\ddeshare.exe
<SYSTEM32>\dfrgntfs.exe
<SYSTEM32>\dfrgfat.exe
<SYSTEM32>\diskperf.exe
<SYSTEM32>\dllcache\arp.exe
<SYSTEM32>\dllcache\alg.exe
<SYSTEM32>\dllcache\asr_pfu.exe
<SYSTEM32>\dllcache\asyncmac.sys
<SYSTEM32>\dllcache\admin.exe
<SYSTEM32>\diskpart.exe
<SYSTEM32>\dllcache\ahui.exe
<SYSTEM32>\dllcache\agentsvr.exe
<SYSTEM32>\cleanmgr.exe
<SYSTEM32>\clipsrv.exe
<SYSTEM32>\cmmon32.exe
<SYSTEM32>\cmdl32.exe
<SYSTEM32>\cipher.exe
<SYSTEM32>\ckcnv.exe
<SYSTEM32>\clipbrd.exe
<SYSTEM32>\cliconfg.exe
<SYSTEM32>\Com\comrepl.exe
<SYSTEM32>\control.exe
<SYSTEM32>\conime.exe
<SYSTEM32>\dcomcnfg.exe
<SYSTEM32>\convert.exe
<SYSTEM32>\Com\comrereg.exe
<SYSTEM32>\cmstp.exe
<SYSTEM32>\comp.exe
<SYSTEM32>\compact.exe
<SYSTEM32>\dllcache\cacls.exe
<SYSTEM32>\dllcache\bootvrfy.exe
<SYSTEM32>\dllcache\chglogon.exe
<SYSTEM32>\dllcache\calc.exe
<SYSTEM32>\dllcache\bootok.exe
<SYSTEM32>\dllcache\beep.sys
<SYSTEM32>\dllcache\bridge.sys
<SYSTEM32>\dllcache\bootcfg.exe
<SYSTEM32>\dllcache\cb32.exe
<SYSTEM32>\dllcache\chgusr.exe
<SYSTEM32>\dllcache\change.exe
<SYSTEM32>\dllcache\chkdsk.exe
<SYSTEM32>\dllcache\chgport.exe
<SYSTEM32>\dllcache\charmap.exe
<SYSTEM32>\dllcache\cdfs.sys
<SYSTEM32>\dllcache\cfgwiz.exe
<SYSTEM32>\dllcache\cap7146.sys
<SYSTEM32>\dllcache\atmuni.sys
<SYSTEM32>\dllcache\atmepvc.sys
<SYSTEM32>\dllcache\attrib.exe
<SYSTEM32>\dllcache\atmarpc.sys
<SYSTEM32>\dllcache\asr_fmt.exe
<SYSTEM32>\dllcache\asr_ldm.exe
<SYSTEM32>\dllcache\atmadm.exe
<SYSTEM32>\dllcache\at.exe
<SYSTEM32>\dllcache\atmlane.sys
<SYSTEM32>\dllcache\autofmt.exe
<SYSTEM32>\dllcache\autolfn.exe
<SYSTEM32>\dllcache\bckgzm.exe
<SYSTEM32>\dllcache\blastcln.exe
<SYSTEM32>\dllcache\auditusr.exe
<SYSTEM32>\dllcache\autochk.exe
<SYSTEM32>\dllcache\author.exe
<SYSTEM32>\dllcache\autoconv.exe
<SYSTEM32>\net1.exe
<SYSTEM32>\net.exe
<SYSTEM32>\netsetup.exe
<SYSTEM32>\netdde.exe
<SYSTEM32>\narrator.exe
<SYSTEM32>\mstsc.exe
<SYSTEM32>\nddeapir.exe
<SYSTEM32>\nbtstat.exe
<SYSTEM32>\netstat.exe
<SYSTEM32>\ntoskrnl.exe
<SYSTEM32>\npp\nppagent.exe
<SYSTEM32>\ntvdm.exe
<SYSTEM32>\ntkrnlpa.exe
<SYSTEM32>\notepad.exe
<SYSTEM32>\netsh.exe
<SYSTEM32>\ntbackup.exe
<SYSTEM32>\nslookup.exe
<SYSTEM32>\mqtgsvc.exe
<SYSTEM32>\mqsvc.exe
<SYSTEM32>\msdtc.exe
<SYSTEM32>\msacm32.drv
<SYSTEM32>\mpnotify.exe
<SYSTEM32>\mplay32.exe
<SYSTEM32>\mrinfo.exe
<SYSTEM32>\mqbkup.exe
<SYSTEM32>\msh261.drv
<SYSTEM32>\msswchx.exe
<SYSTEM32>\mstinit.exe
<SYSTEM32>\mspaint.exe
<SYSTEM32>\msiexec.exe
<SYSTEM32>\msh263.drv
<SYSTEM32>\msg.exe
<SYSTEM32>\mshearts.exe
<SYSTEM32>\mshta.exe
<SYSTEM32>\qprocess.exe
<SYSTEM32>\PresentationHost.exe
<SYSTEM32>\qwinsta.exe
<SYSTEM32>\rasautou.exe
<SYSTEM32>\qappsrv.exe
<SYSTEM32>\ping6.exe
<SYSTEM32>\proxycfg.exe
<SYSTEM32>\proquota.exe
<SYSTEM32>\rasdial.exe
<SYSTEM32>\rdsaddin.exe
<SYSTEM32>\rdshost.exe
<SYSTEM32>\regsvr32.exe
<SYSTEM32>\recover.exe
<SYSTEM32>\rdpclip.exe
<SYSTEM32>\rasphone.exe
<SYSTEM32>\rcimlby.exe
<SYSTEM32>\rcp.exe
<SYSTEM32>\oobe\msoobe.exe
<SYSTEM32>\oobe\oobebaln.exe
<SYSTEM32>\pathping.exe
<SYSTEM32>\osk.exe
<SYSTEM32>\nwscript.exe
<SYSTEM32>\ntsd.exe
<SYSTEM32>\odbcconf.exe
<SYSTEM32>\odbcad32.exe
<SYSTEM32>\osuninst.exe
<SYSTEM32>\powercfg.exe
<SYSTEM32>\ping.exe
<SYSTEM32>\progman.exe
<SYSTEM32>\print.exe
<SYSTEM32>\packager.exe
<SYSTEM32>\openfiles.exe
<SYSTEM32>\perfmon.exe
<SYSTEM32>\pentnt.exe
<SYSTEM32>\eventcreate.exe
<SYSTEM32>\fc.exe
<SYSTEM32>\extrac32.exe
<SYSTEM32>\eventtriggers.exe
<SYSTEM32>\eudcedit.exe
<SYSTEM32>\esentutl.exe
<SYSTEM32>\expand.exe
<SYSTEM32>\eventvwr.exe
<SYSTEM32>\find.exe
<SYSTEM32>\forcedos.exe
<SYSTEM32>\fontview.exe
<SYSTEM32>\fsquirt.exe
<SYSTEM32>\ftp.exe
<SYSTEM32>\finger.exe
<SYSTEM32>\findstr.exe
<SYSTEM32>\fltMc.exe
<SYSTEM32>\fixmapi.exe
<DRIVERS>\vga.sys
<DRIVERS>\videoprt.sys
<DRIVERS>\wmilib.sys
<DRIVERS>\ws2ifsl.sys
<DRIVERS>\vdmindvd.sys
<DRIVERS>\update.sys
<DRIVERS>\volsnap.sys
<DRIVERS>\usbintel.sys
<DRIVERS>\wanarp.sys
<SYSTEM32>\dvdplay.exe
<SYSTEM32>\dwwin.exe
<SYSTEM32>\dxdiag.exe
<SYSTEM32>\dvdupgrd.exe
<DRIVERS>\xxhgfs.sys
<DRIVERS>\xrwebvirtnet.sys
<SYSTEM32>\dumprep.exe
<SYSTEM32>\drwtsn32.exe
<SYSTEM32>\logonui.exe
<SYSTEM32>\logagent.exe
<SYSTEM32>\logman.exe
<SYSTEM32>\lpr.exe
<SYSTEM32>\locator.exe
<SYSTEM32>\lnkstub.exe
<SYSTEM32>\lights.exe
<SYSTEM32>\lodctr.exe
<SYSTEM32>\magnify.exe
<SYSTEM32>\mnmsrvc.exe
<SYSTEM32>\migpwd.exe
<SYSTEM32>\mountvol.exe
<SYSTEM32>\mobsync.exe
<SYSTEM32>\lpq.exe
<SYSTEM32>\logoff.exe
<SYSTEM32>\mmc.exe
<SYSTEM32>\makecab.exe
<SYSTEM32>\help.exe
<SYSTEM32>\grpconv.exe
<SYSTEM32>\hostname.exe
<SYSTEM32>\gpupdate.exe
<SYSTEM32>\getmac.exe
<SYSTEM32>\freecell.exe
<SYSTEM32>\gpresult.exe
<SYSTEM32>\fsutil.exe
<SYSTEM32>\icardagt.exe
<SYSTEM32>\ie4uinit.exe
<SYSTEM32>\ipsec6.exe
<SYSTEM32>\label.exe
<SYSTEM32>\ipxroute.exe
<SYSTEM32>\ipv6.exe
<SYSTEM32>\imapi.exe
<SYSTEM32>\ipconfig.exe
<SYSTEM32>\iexpress.exe
<SYSTEM32>\regwiz.exe
<SYSTEM32>\usrprbda.exe
<SYSTEM32>\usrshuta.exe
<SYSTEM32>\utilman.exe
<SYSTEM32>\vssadmin.exe
<SYSTEM32>\URTTEMP\regtlib.exe
<SYSTEM32>\usmt\migwiz.exe
<SYSTEM32>\usrmlnka.exe
<SYSTEM32>\usmt\migwiz_a.exe
<SYSTEM32>\verifier.exe
<SYSTEM32>\wbem\wbemtest.exe
<SYSTEM32>\wbem\mofcomp.exe
<SYSTEM32>\wbem\winmgmt.exe
<SYSTEM32>\w32tm.exe
<SYSTEM32>\wbem\scrcons.exe
<SYSTEM32>\vssvc.exe
<SYSTEM32>\watchdog.sys
<SYSTEM32>\wbem\unsecapp.exe
<SYSTEM32>\tscupgrd.exe
<SYSTEM32>\tscon.exe
<SYSTEM32>\tsdiscon.exe
<SYSTEM32>\tourstart.exe
<SYSTEM32>\tracert6.exe
<SYSTEM32>\tracerpt.exe
<SYSTEM32>\tracert.exe
<SYSTEM32>\tlntsvr.exe
<SYSTEM32>\tskill.exe
<SYSTEM32>\ups.exe
<SYSTEM32>\typeperf.exe
<SYSTEM32>\userinit.exe
<SYSTEM32>\usmt\migload.exe
<SYSTEM32>\upnpcont.exe
<SYSTEM32>\tsshutdn.exe
<SYSTEM32>\TsWpfWrp.exe
<SYSTEM32>\unlodctr.exe
%WINDIR%\twunk_32.exe
%WINDIR%\TASKMAN.EXE
%WINDIR%\XXInstall\cmdow.exe
%WINDIR%\XXInstall\devcon.exe
<SYSTEM32>\wuauclt.exe
<SYSTEM32>\XPSViewer\XPSViewer.exe
<SYSTEM32>\xcopy.exe
<SYSTEM32>\wscript.exe
%WINDIR%\XXInstall\exdir.exe
%WINDIR%\XXInstall\hashdeep.exe
%WINDIR%\XXInstall\Scripts\antivm.exe
%WINDIR%\XXInstall\vminstall.exe
%WINDIR%\winhlp32.exe
%WINDIR%\XXInstall\ps.exe
%WINDIR%\XXInstall\events.exe
%WINDIR%\XXInstall\screen.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
<SYSTEM32>\wiaacmgr.exe
<SYSTEM32>\wdmaud.drv
<SYSTEM32>\winmsd.exe
<SYSTEM32>\winhlp32.exe
<SYSTEM32>\wbem\wmiadap.exe
<SYSTEM32>\wbem\wmiapsrv.exe
<SYSTEM32>\wextract.exe
<SYSTEM32>\wbem\wmic.exe
<SYSTEM32>\winchat.exe
<SYSTEM32>\write.exe
<SYSTEM32>\wpnpinst.exe
<SYSTEM32>\wuauclt1.exe
<SYSTEM32>\wupdmgr.exe
<SYSTEM32>\winver.exe
<SYSTEM32>\winmine.exe
<SYSTEM32>\wscntfy.exe
<SYSTEM32>\wpabaln.exe
<SYSTEM32>\rwinsta.exe
<SYSTEM32>\runonce.exe
<SYSTEM32>\savedump.exe
<SYSTEM32>\scardsvr.exe
<SYSTEM32>\rsnotify.exe
<SYSTEM32>\rtcshare.exe
<SYSTEM32>\rundll32.exe
<SYSTEM32>\rsvp.exe
<SYSTEM32>\sc.exe
<SYSTEM32>\sessmgr.exe
<SYSTEM32>\sethc.exe
<SYSTEM32>\sfc.exe
<SYSTEM32>\shadow.exe
<SYSTEM32>\sdbinst.exe
<SYSTEM32>\schtasks.exe
<SYSTEM32>\setup.exe
<SYSTEM32>\secedit.exe
<SYSTEM32>\relog.exe
<SYSTEM32>\replace.exe
<SYSTEM32>\Restore\srdiag.exe
<SYSTEM32>\Restore\rstrui.exe
<SYSTEM32>\regini.exe
<SYSTEM32>\reg.exe
<SYSTEM32>\reset.exe
<SYSTEM32>\regedt32.exe
<SYSTEM32>\route.exe
<SYSTEM32>\rsmui.exe
<SYSTEM32>\rsmsink.exe
<SYSTEM32>\runas.exe
<SYSTEM32>\rsopprov.exe
<SYSTEM32>\routemon.exe
<SYSTEM32>\rexec.exe
<SYSTEM32>\rsh.exe
<SYSTEM32>\rsm.exe
<SYSTEM32>\systray.exe
<SYSTEM32>\syskey.exe
<SYSTEM32>\taskmgr.exe
<SYSTEM32>\systeminfo.exe
<SYSTEM32>\stimon.exe
<SYSTEM32>\syncapp.exe
<SYSTEM32>\sysocmgr.exe
<SYSTEM32>\spupdsvc.exe
<SYSTEM32>\tcmsetup.exe
<SYSTEM32>\telnet.exe
<SYSTEM32>\taskman.exe
<SYSTEM32>\tlntsess.exe
<SYSTEM32>\tftp.exe
<SYSTEM32>\tcpsvcs.exe
<SYSTEM32>\taskkill.exe
<SYSTEM32>\tlntadmn.exe
<SYSTEM32>\tasklist.exe
<SYSTEM32>\skeys.exe
<SYSTEM32>\smbinst.exe
<SYSTEM32>\sndrec32.exe
<SYSTEM32>\smlogsvc.exe
<SYSTEM32>\sigverif.exe
<SYSTEM32>\shrpubw.exe
<SYSTEM32>\shutdown.exe
<SYSTEM32>\shmgrate.exe
<SYSTEM32>\sol.exe
<SYSTEM32>\spnpinst.exe
<SYSTEM32>\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
<SYSTEM32>\subst.exe
<SYSTEM32>\sprestrt.exe
<SYSTEM32>\sort.exe
<SYSTEM32>\sndvol32.exe
<SYSTEM32>\spiisupd.exe
<SYSTEM32>\spider.exe
<SYSTEM32>\dllcache\winchat.exe
<SYSTEM32>\dllcache\win32k.sys
<SYSTEM32>\dllcache\winhlp32.exe
<SYSTEM32>\dllcache\winlogon.exe
<SYSTEM32>\dllcache\wbemtest.exe
<SYSTEM32>\dllcache\wextract.exe
<SYSTEM32>\dllcache\weitekp9.sys
<SYSTEM32>\dllcache\wiaacmgr.exe
<SYSTEM32>\dllcache\winmsd.exe
<SYSTEM32>\dllcache\winver.exe
<SYSTEM32>\dllcache\wmiapsrv.exe
<SYSTEM32>\dllcache\wmilib.sys
<SYSTEM32>\dllcache\wmiadap.exe
<SYSTEM32>\dllcache\winmgmt.exe
<SYSTEM32>\dllcache\winmine.exe
<SYSTEM32>\dllcache\winspool.drv
<SYSTEM32>\dllcache\winhstb.exe
<SYSTEM32>\dllcache\verifier.exe
<SYSTEM32>\dllcache\usb8023.sys
<SYSTEM32>\dllcache\vga.sys
<SYSTEM32>\dllcache\volsnap.sys
<SYSTEM32>\dllcache\utilman.exe
<SYSTEM32>\dllcache\unsecapp.exe
<SYSTEM32>\dllcache\userinit.exe
<SYSTEM32>\dllcache\uploadm.exe
<SYSTEM32>\dllcache\videoprt.sys
<SYSTEM32>\dllcache\wanarp.sys
<SYSTEM32>\dllcache\wabmig.exe
<SYSTEM32>\dllcache\wb32.exe
<SYSTEM32>\dllcache\watchdog.sys
<SYSTEM32>\dllcache\vssadmin.exe
<SYSTEM32>\dllcache\vssvc.exe
<SYSTEM32>\dllcache\w32tm.exe
<SYSTEM32>\dllcache\wab.exe
<DRIVERS>\acpiec.sys
<DRIVERS>\afd.sys
<DRIVERS>\amdk7.sys
<DRIVERS>\AGP440.SYS
<SYSTEM32>\dmadmin.exe
<SYSTEM32>\dllhst3g.exe
<SYSTEM32>\doskey.exe
<DRIVERS>\acpi.sys
<DRIVERS>\amdk6.sys
<DRIVERS>\arp1394.sys
<DRIVERS>\atapi.sys
<DRIVERS>\atmepvc.sys
<DRIVERS>\asyncmac.sys
<SYSTEM32>\driverquery.exe
<SYSTEM32>\dplaysvr.exe
<SYSTEM32>\dpvsetup.exe
<SYSTEM32>\dpnsvr.exe
<SYSTEM32>\dllcache\wuauclt.exe
<SYSTEM32>\dllcache\wpabaln.exe
<SYSTEM32>\dllcache\wpnpinst.exe
<SYSTEM32>\dllcache\write.exe
<SYSTEM32>\dllcache\wmic.exe
<SYSTEM32>\dllcache\wmiprvse.exe
<SYSTEM32>\dllcache\wmplayer.exe
<SYSTEM32>\dllcache\wordpad.exe
<SYSTEM32>\dllcache\wscript.exe
<SYSTEM32>\dllcache\xcopy.exe
<SYSTEM32>\dllcache\zclientm.exe
<SYSTEM32>\dllhost.exe
<SYSTEM32>\dmremote.exe
<SYSTEM32>\dllcache\ws2ifsl.sys
<SYSTEM32>\dllcache\wscntfy.exe
<SYSTEM32>\dllcache\wuauclt1.exe
<SYSTEM32>\dllcache\wupdmgr.exe
<SYSTEM32>\dllcache\syskey.exe
<SYSTEM32>\dllcache\svchost.exe
<SYSTEM32>\dllcache\sysocmgr.exe
<SYSTEM32>\dllcache\sysinfo.exe
<SYSTEM32>\dllcache\stimon.exe
<SYSTEM32>\dllcache\sr.sys
<SYSTEM32>\dllcache\subst.exe
<SYSTEM32>\dllcache\syncapp.exe
<SYSTEM32>\dllcache\systray.exe
<SYSTEM32>\dllcache\tcmsetup.exe
<SYSTEM32>\dllcache\tcpip.sys
<SYSTEM32>\dllcache\tcpip6.sys
<SYSTEM32>\dllcache\taskman.exe
<SYSTEM32>\dllcache\tape.sys
<SYSTEM32>\dllcache\taskkill.exe
<SYSTEM32>\dllcache\taskmgr.exe
<SYSTEM32>\dllcache\tasklist.exe
<SYSTEM32>\dllcache\sndvol32.exe
<SYSTEM32>\dllcache\smlogsvc.exe
<SYSTEM32>\dllcache\snmptrap.exe
<SYSTEM32>\dllcache\snmp.exe
<SYSTEM32>\dllcache\smi2smir.exe
<SYSTEM32>\dllcache\smss.exe
<SYSTEM32>\dllcache\sigverif.exe
<SYSTEM32>\dllcache\sndrec32.exe
<SYSTEM32>\dllcache\sol.exe
<SYSTEM32>\dllcache\sprestrt.exe
<SYSTEM32>\dllcache\spoolsv.exe
<SYSTEM32>\dllcache\srv.sys
<SYSTEM32>\dllcache\srdiag.exe
<SYSTEM32>\dllcache\spider.exe
<SYSTEM32>\dllcache\sort.exe
<SYSTEM32>\dllcache\spiisupd.exe
<SYSTEM32>\dllcache\spnpinst.exe
<SYSTEM32>\dllcache\tracert6.exe
<SYSTEM32>\dllcache\tsdiscon.exe
<SYSTEM32>\dllcache\tskill.exe
<SYSTEM32>\dllcache\tscupgrd.exe
<SYSTEM32>\dllcache\tracert.exe
<SYSTEM32>\dllcache\tracerpt.exe
<SYSTEM32>\dllcache\tscon.exe
<SYSTEM32>\dllcache\tsprof.exe
<SYSTEM32>\dllcache\tsshutdn.exe
<SYSTEM32>\dllcache\ups.exe
<SYSTEM32>\dllcache\unregmp2.exe
<SYSTEM32>\dllcache\upnpcont.exe
<SYSTEM32>\dllcache\update.sys
<SYSTEM32>\dllcache\udfs.sys
<SYSTEM32>\dllcache\typeperf.exe
<SYSTEM32>\dllcache\unlodctr.exe
<SYSTEM32>\dllcache\twunk_32.exe
<SYSTEM32>\dllcache\telnet.exe
<SYSTEM32>\dllcache\tdipx.sys
<SYSTEM32>\dllcache\tdtcp.sys
<SYSTEM32>\dllcache\tdspx.sys
<SYSTEM32>\dllcache\tcpsvcs.exe
<SYSTEM32>\dllcache\tcptest.exe
<SYSTEM32>\dllcache\tdpipe.sys
<SYSTEM32>\dllcache\tdasync.sys
<SYSTEM32>\dllcache\tdi.sys
<SYSTEM32>\dllcache\tourW.exe
<SYSTEM32>\dllcache\tourstrt.exe
<SYSTEM32>\dllcache\tlntsvr.exe
<SYSTEM32>\dllcache\tlntsess.exe
<SYSTEM32>\dllcache\tintlphr.exe
<SYSTEM32>\dllcache\tftp.exe
<SYSTEM32>\dllcache\tlntadmn.exe
<SYSTEM32>\dllcache\tintsetp.exe
<DRIVERS>\atmarpc.sys
<DRIVERS>\raspti.sys
<DRIVERS>\rasacd.sys
<DRIVERS>\psched.sys
<DRIVERS>\ptilink.sys
<DRIVERS>\pci.sys
<DRIVERS>\parvdm.sys
<DRIVERS>\pciidex.sys
<DRIVERS>\pcmcia.sys
<DRIVERS>\processr.sys
<DRIVERS>\rawwan.sys
<DRIVERS>\raspptp.sys
<DRIVERS>\rdpdr.sys
<DRIVERS>\redbook.sys
<DRIVERS>\rdpcdd.sys
<DRIVERS>\raspppoe.sys
<DRIVERS>\rdbss.sys
<DRIVERS>\rasl2tp.sys
<DRIVERS>\null.sys
<DRIVERS>\nikedrv.sys
<DRIVERS>\nwrdr.sys
<DRIVERS>\nmnt.sys
<DRIVERS>\netbt.sys
<DRIVERS>\ndproxy.sys
<DRIVERS>\ntfs.sys
<DRIVERS>\npfs.sys
<DRIVERS>\nwlnknb.sys
<DRIVERS>\oprghdlr.sys
<DRIVERS>\nwlnkfwd.sys
<DRIVERS>\partmgr.sys
<DRIVERS>\parport.sys
<DRIVERS>\nwlnkflt.sys
<DRIVERS>\nwlnkipx.sys
<DRIVERS>\p3.sys
<DRIVERS>\nwlnkspx.sys
<DRIVERS>\tcpip6.sys
<DRIVERS>\tcpip.sys
<DRIVERS>\tdtcp.sys
<DRIVERS>\tdi.sys
<DRIVERS>\stream.sys
<DRIVERS>\srv.sys
<DRIVERS>\tape.sys
<DRIVERS>\swenum.sys
<DRIVERS>\tdpipe.sys
<DRIVERS>\usb8023.sys
<DRIVERS>\tunmp.sys
<DRIVERS>\usbcamd.sys
<DRIVERS>\usbcamd2.sys
<DRIVERS>\termdd.sys
<DRIVERS>\tosdvd.sys
<DRIVERS>\tsbvcap.sys
<DRIVERS>\udfs.sys
<DRIVERS>\rndismp.sys
<DRIVERS>\rootmdm.sys
<DRIVERS>\sdbus.sys
<DRIVERS>\scsiport.sys
<DRIVERS>\riodrv.sys
<DRIVERS>\rdpwd.sys
<DRIVERS>\RMCast.sys
<DRIVERS>\rio8drv.sys
<DRIVERS>\serial.sys
<DRIVERS>\smclib.sys
<DRIVERS>\sffdisk.sys
<DRIVERS>\sr.sys
<DRIVERS>\sonydcam.sys
<DRIVERS>\serenum.sys
<DRIVERS>\secdrv.sys
<DRIVERS>\sffp_sd.sys
<DRIVERS>\sfloppy.sys
<DRIVERS>\dxapi.sys
<DRIVERS>\dmload.sys
<DRIVERS>\eventmon.sys
<DRIVERS>\dxgthk.sys
<DRIVERS>\disk.sys
<DRIVERS>\dmboot.sys
<DRIVERS>\dmio.sys
<DRIVERS>\DbgPrnHk.sys
<DRIVERS>\fdc.sys
<DRIVERS>\i8042prt.sys
<DRIVERS>\flpydisk.sys
<DRIVERS>\imapi.sys
<DRIVERS>\fltMgr.sys
<DRIVERS>\fastfat.sys
<DRIVERS>\filedisk.sys
<DRIVERS>\fsvga.sys
<DRIVERS>\fips.sys
<DRIVERS>\bridge.sys
<DRIVERS>\beep.sys
<DRIVERS>\cdaudio.sys
<DRIVERS>\cinemst2.sys
<DRIVERS>\atmuni.sys
<DRIVERS>\atmlane.sys
<DRIVERS>\battc.sys
<DRIVERS>\audstub.sys
<DRIVERS>\crusoe.sys
<DRIVERS>\classpnp.sys
<DRIVERS>\cpqdap01.sys
<DRIVERS>\diskdump.sys
<DRIVERS>\compbatt.sys
<DRIVERS>\cdfs.sys
<DRIVERS>\cdrom.sys
<DRIVERS>\CmBatt.sys
<DRIVERS>\cbidf2k.sys
<DRIVERS>\mqac.sys
<DRIVERS>\mrxdav.sys
<DRIVERS>\msfs.sys
<DRIVERS>\mrxsmb.sys
<DRIVERS>\modem.sys
<DRIVERS>\mnmdd.sys
<DRIVERS>\mouclass.sys
<DRIVERS>\mountmgr.sys
<DRIVERS>\ndistapi.sys
<DRIVERS>\ndiswan.sys
<DRIVERS>\ndisuio.sys
<DRIVERS>\netbios.sys
<DRIVERS>\nic1394.sys
<DRIVERS>\mup.sys
<DRIVERS>\mssmbios.sys
<DRIVERS>\ndis.sys
<DRIVERS>\msgpc.sys
<DRIVERS>\intelppm.sys
<DRIVERS>\ip6fw.sys
<DRIVERS>\ipfltdrv.sys
<DRIVERS>\ipinip.sys
<DRIVERS>\fs_rec.sys
<DRIVERS>\intelide.sys
<DRIVERS>\ftdisk.sys
<DRIVERS>\http.sys
<DRIVERS>\ipnat.sys
<DRIVERS>\ksecdd.sys
<DRIVERS>\irenum.sys
<DRIVERS>\mcd.sys
<DRIVERS>\mf.sys
<DRIVERS>\ks.sys
<DRIVERS>\ipsec.sys
<DRIVERS>\isapnp.sys
<DRIVERS>\kbdclass.sys

Подменяет следующие исполняемые системные файлы:

<SYSTEM32>\dllcache\lpr.exe
<SYSTEM32>\dllcache\lsass.exe
<SYSTEM32>\dllcache\makecab.exe
<SYSTEM32>\dllcache\magnify.exe
<SYSTEM32>\dllcache\logonui.exe
<SYSTEM32>\dllcache\lodctr.exe
<SYSTEM32>\dllcache\lpq.exe
<SYSTEM32>\dllcache\locator.exe
<SYSTEM32>\dllcache\mcd.sys
<SYSTEM32>\dllcache\migisol.exe
<SYSTEM32>\dllcache\migwiz.exe
<SYSTEM32>\dllcache\migregdb.exe
<SYSTEM32>\dllcache\migwiz_a.exe
<SYSTEM32>\dllcache\migrate.exe
<SYSTEM32>\dllcache\mga.sys
<SYSTEM32>\dllcache\moviemk.exe
<SYSTEM32>\dllcache\mmc.exe
<SYSTEM32>\dllcache\ipxroute.exe
<SYSTEM32>\dllcache\ipsec.sys
<SYSTEM32>\dllcache\ipsec6.exe
<SYSTEM32>\dllcache\ksecdd.sys
<SYSTEM32>\dllcache\ipconfig.exe
<SYSTEM32>\dllcache\ipfltdrv.sys
<SYSTEM32>\dllcache\ipnat.sys
<SYSTEM32>\dllcache\ipinip.sys
<SYSTEM32>\dllcache\ipv6.exe
<SYSTEM32>\dllcache\logman.exe
<SYSTEM32>\dllcache\lights.exe
<SYSTEM32>\dllcache\lnkstub.exe
<SYSTEM32>\dllcache\logagent.exe
<SYSTEM32>\dllcache\irenum.sys
<SYSTEM32>\dllcache\isignup.exe
<SYSTEM32>\dllcache\logoff.exe
<SYSTEM32>\dllcache\label.exe
<SYSTEM32>\dllcache\msgpc.sys
<SYSTEM32>\dllcache\mshearts.exe
<SYSTEM32>\dllcache\msimn.exe
<SYSTEM32>\dllcache\msiexec.exe
<SYSTEM32>\dllcache\msfs.sys
<SYSTEM32>\dllcache\mrxdav.sys
<SYSTEM32>\dllcache\msg.exe
<SYSTEM32>\dllcache\mshta.exe
<SYSTEM32>\dllcache\mspaint.exe
<SYSTEM32>\dllcache\mstsc.exe
<SYSTEM32>\dllcache\mstinit.exe
<SYSTEM32>\dllcache\mup.sys
<SYSTEM32>\dllcache\muisetup.exe
<SYSTEM32>\dllcache\msiregmv.exe
<SYSTEM32>\dllcache\msinfo32.exe
<SYSTEM32>\dllcache\msswchx.exe
<SYSTEM32>\dllcache\msoobe.exe
<SYSTEM32>\dllcache\mountmgr.sys
<SYSTEM32>\dllcache\mofcomp.exe
<SYSTEM32>\dllcache\mqbkup.exe
<SYSTEM32>\dllcache\mountvol.exe
<SYSTEM32>\dllcache\mnmdd.sys
<SYSTEM32>\dllcache\migload.exe
<SYSTEM32>\dllcache\mnmsrvc.exe
<SYSTEM32>\dllcache\mobsync.exe
<SYSTEM32>\dllcache\mqac.sys
<SYSTEM32>\dllcache\msconfig.exe
<SYSTEM32>\dllcache\mrinfo.exe
<SYSTEM32>\dllcache\mqtgsvc.exe
<SYSTEM32>\dllcache\msdtc.exe
<SYSTEM32>\dllcache\mplay32.exe
<SYSTEM32>\dllcache\mplayer2.exe
<SYSTEM32>\dllcache\mpnotify.exe
<SYSTEM32>\dllcache\mqsvc.exe
<SYSTEM32>\dllcache\fxsclnt.exe
<SYSTEM32>\dllcache\freecell.exe
<SYSTEM32>\dllcache\fxscover.exe
<SYSTEM32>\dllcache\fs_rec.sys
<SYSTEM32>\dllcache\fpremadm.exe
<SYSTEM32>\dllcache\fp98sadm.exe
<SYSTEM32>\dllcache\fsutil.exe
<SYSTEM32>\dllcache\fpcount.exe
<SYSTEM32>\dllcache\fxssend.exe
<SYSTEM32>\dllcache\gprslt.exe
<SYSTEM32>\dllcache\helpctr.exe
<SYSTEM32>\dllcache\grpconv.exe
<SYSTEM32>\dllcache\help.exe
<SYSTEM32>\dllcache\fxssvc.exe
<SYSTEM32>\dllcache\ftp.exe
<SYSTEM32>\dllcache\gpupdate.exe
<SYSTEM32>\dllcache\getmac.exe
<SYSTEM32>\dllcache\finger.exe
<SYSTEM32>\dllcache\EXCH_regtrace.exe
<SYSTEM32>\dllcache\fixmapi.exe
<SYSTEM32>\dllcache\findstr.exe
<SYSTEM32>\dllcache\fastfat.sys
<SYSTEM32>\dllcache\expand.exe
<SYSTEM32>\dllcache\fc.exe
<SYSTEM32>\dllcache\extrac32.exe
<SYSTEM32>\dllcache\find.exe
<SYSTEM32>\dllcache\fltmgr.sys
<SYSTEM32>\dllcache\forcedos.exe
<SYSTEM32>\dllcache\fpadmcgi.exe
<SYSTEM32>\dllcache\fp98swin.exe
<SYSTEM32>\dllcache\fontview.exe
<SYSTEM32>\dllcache\fips.sys
<SYSTEM32>\dllcache\flattemp.exe
<SYSTEM32>\dllcache\fltmc.exe
<SYSTEM32>\dllcache\imjputy.exe
<SYSTEM32>\dllcache\imjprw.exe
<SYSTEM32>\dllcache\imjpinst.exe
<SYSTEM32>\dllcache\imjpdct.exe
<SYSTEM32>\dllcache\imekrmig.exe
<SYSTEM32>\dllcache\iissync.exe
<SYSTEM32>\dllcache\imjpdadm.exe
<SYSTEM32>\dllcache\imepadsv.exe
<SYSTEM32>\dllcache\imjpmig.exe
<SYSTEM32>\dllcache\inetwiz.exe
<SYSTEM32>\dllcache\inetmgr.exe
<SYSTEM32>\dllcache\ip6fw.sys
<SYSTEM32>\dllcache\imscinst.exe
<SYSTEM32>\dllcache\imjpdsvr.exe
<SYSTEM32>\dllcache\imjpuex.exe
<SYSTEM32>\dllcache\inetin51.exe
<SYSTEM32>\dllcache\imkrinst.exe
<SYSTEM32>\dllcache\hscupd.exe
<SYSTEM32>\dllcache\hrtzzm.exe
<SYSTEM32>\dllcache\hostname.exe
<SYSTEM32>\dllcache\icwconn2.exe
<SYSTEM32>\dllcache\helphost.exe
<SYSTEM32>\dllcache\hh.exe
<SYSTEM32>\dllcache\icwconn1.exe
<SYSTEM32>\dllcache\helpsvc.exe
<SYSTEM32>\dllcache\icwtutor.exe
<SYSTEM32>\dllcache\iisrstas.exe
<SYSTEM32>\dllcache\iexpress.exe
<SYSTEM32>\dllcache\imapi.exe
<SYSTEM32>\dllcache\iisreset.exe
<SYSTEM32>\dllcache\ie4uinit.exe
<SYSTEM32>\dllcache\icwrmind.exe
<SYSTEM32>\dllcache\iexplore.exe
<SYSTEM32>\dllcache\iedw.exe
<SYSTEM32>\dllcache\relog.exe
<SYSTEM32>\dllcache\replace.exe
<SYSTEM32>\dllcache\regwiz.exe
<SYSTEM32>\dllcache\rexec.exe
<SYSTEM32>\dllcache\rdpwd.sys
<SYSTEM32>\dllcache\recover.exe
<SYSTEM32>\dllcache\regsvr32.exe
<SYSTEM32>\dllcache\register.exe
<SYSTEM32>\dllcache\reset.exe
<SYSTEM32>\dllcache\rstrui.exe
<SYSTEM32>\dllcache\rmcast.sys
<SYSTEM32>\dllcache\rsnotify.exe
<SYSTEM32>\dllcache\rsmsink.exe
<SYSTEM32>\dllcache\rndismp.sys
<SYSTEM32>\dllcache\rootmdm.sys
<SYSTEM32>\dllcache\rsm.exe
<SYSTEM32>\dllcache\routemon.exe
<SYSTEM32>\dllcache\rdshost.exe
<SYSTEM32>\dllcache\rawwan.sys
<SYSTEM32>\dllcache\raspptp.sys
<SYSTEM32>\dllcache\rcp.exe
<SYSTEM32>\dllcache\ramdisk.sys
<SYSTEM32>\dllcache\rasl2tp.sys
<SYSTEM32>\dllcache\raspppoe.sys
<SYSTEM32>\dllcache\raspti.sys
<SYSTEM32>\dllcache\rcimlby.exe
<SYSTEM32>\dllcache\rdbss.sys
<SYSTEM32>\dllcache\reg.exe
<SYSTEM32>\dllcache\rdpclip.exe
<SYSTEM32>\dllcache\regedit.exe
<SYSTEM32>\dllcache\regedt32.exe
<SYSTEM32>\dllcache\rdsaddin.exe
<SYSTEM32>\dllcache\regini.exe
<SYSTEM32>\dllcache\rdpcdd.sys
<SYSTEM32>\dllcache\secedit.exe
<SYSTEM32>\dllcache\sessmgr.exe
<SYSTEM32>\dllcache\sethc.exe
<SYSTEM32>\dllcache\setup50.exe
<SYSTEM32>\dllcache\sc.exe
<SYSTEM32>\dllcache\setup_wm.exe
<SYSTEM32>\dllcache\services.exe
<SYSTEM32>\dllcache\sfc.exe
<SYSTEM32>\dllcache\setup.exe
<SYSTEM32>\dllcache\skeys.exe
<SYSTEM32>\dllcache\smclib.sys
<SYSTEM32>\dllcache\smbinst.exe
<SYSTEM32>\dllcache\smss.exe
<SYSTEM32>\dllcache\shrpubw.exe
<SYSTEM32>\dllcache\shadow.exe
<SYSTEM32>\dllcache\shvlzm.exe
<SYSTEM32>\dllcache\shutdown.exe
<SYSTEM32>\dllcache\rsmui.exe
<SYSTEM32>\dllcache\runas.exe
<SYSTEM32>\dllcache\runonce.exe
<SYSTEM32>\dllcache\rtcshare.exe
<SYSTEM32>\dllcache\rsh.exe
<SYSTEM32>\dllcache\route.exe
<SYSTEM32>\dllcache\rsvp.exe
<SYSTEM32>\dllcache\rsopprov.exe
<SYSTEM32>\dllcache\scardsvr.exe
<SYSTEM32>\dllcache\savedump.exe
<SYSTEM32>\dllcache\sctasks.exe
<SYSTEM32>\dllcache\scrcons.exe
<SYSTEM32>\dllcache\sdbinst.exe
<SYSTEM32>\dllcache\rundll32.exe
<SYSTEM32>\dllcache\rvsezm.exe
<SYSTEM32>\dllcache\sapisvr.exe
<SYSTEM32>\dllcache\rwinsta.exe
<SYSTEM32>\dllcache\nslookup.exe
<SYSTEM32>\dllcache\nppagent.exe
<SYSTEM32>\dllcache\ntvdm.exe
<SYSTEM32>\dllcache\ntfs.sys
<SYSTEM32>\dllcache\nmnt.sys
<SYSTEM32>\dllcache\notiflag.exe
<SYSTEM32>\dllcache\ntbackup.exe
<SYSTEM32>\dllcache\npfs.sys
<SYSTEM32>\dllcache\null.sys
<SYSTEM32>\dllcache\nwlnkspx.sys
<SYSTEM32>\dllcache\nwlnknb.sys
<SYSTEM32>\dllcache\nwscript.exe
<SYSTEM32>\dllcache\nwrdr.sys
<SYSTEM32>\dllcache\nwlnkfwd.sys
<SYSTEM32>\dllcache\ntsd.exe
<SYSTEM32>\dllcache\nwlnkipx.sys
<SYSTEM32>\dllcache\nwlnkflt.sys
<SYSTEM32>\dllcache\nddeapir.exe
<SYSTEM32>\dllcache\ndistapi.sys
<SYSTEM32>\dllcache\net1.exe
<SYSTEM32>\dllcache\ndiswan.sys
<SYSTEM32>\dllcache\narrator.exe
<SYSTEM32>\dllcache\mtstocom.exe
<SYSTEM32>\dllcache\nbtstat.exe
<SYSTEM32>\dllcache\ndis.sys
<SYSTEM32>\dllcache\netbios.sys
<SYSTEM32>\dllcache\netsh.exe
<SYSTEM32>\dllcache\netdde.exe
<SYSTEM32>\dllcache\netstat.exe
<SYSTEM32>\dllcache\notepad.exe
<SYSTEM32>\dllcache\netsetup.exe
<SYSTEM32>\dllcache\net.exe
<SYSTEM32>\dllcache\netbt.sys
<SYSTEM32>\dllcache\ndproxy.sys
<SYSTEM32>\dllcache\proxycfg.exe
<SYSTEM32>\dllcache\qprocess.exe
<SYSTEM32>\dllcache\quser.exe
<SYSTEM32>\dllcache\progman.exe
<SYSTEM32>\dllcache\proquota.exe
<SYSTEM32>\dllcache\print.exe
<SYSTEM32>\dllcache\powercfg.exe
<SYSTEM32>\dllcache\ptilink.sys
<SYSTEM32>\dllcache\qappsrv.exe
<SYSTEM32>\dllcache\rasdial.exe
<SYSTEM32>\dllcache\rasacd.sys
<SYSTEM32>\dllcache\rasphone.exe
<SYSTEM32>\dllcache\printfilterpipelinesvc.exe
<SYSTEM32>\dllcache\qwinsta.exe
<SYSTEM32>\dllcache\query.exe
<SYSTEM32>\dllcache\rasautou.exe
<SYSTEM32>\dllcache\psched.sys
<SYSTEM32>\dllcache\perfmon.exe
<SYSTEM32>\dllcache\oobebaln.exe
<SYSTEM32>\dllcache\osk.exe
<SYSTEM32>\dllcache\opnfiles.exe
<SYSTEM32>\dllcache\packager.exe
<SYSTEM32>\dllcache\oemig50.exe
<SYSTEM32>\dllcache\odbcconf.exe
<SYSTEM32>\dllcache\odbcad32.exe
<SYSTEM32>\dllcache\parvdm.sys
<SYSTEM32>\dllcache\partmgr.sys
<SYSTEM32>\dllcache\pentnt.exe
<SYSTEM32>\dllcache\pintlphr.exe
<SYSTEM32>\dllcache\ping6.exe
<SYSTEM32>\dllcache\ping.exe
<SYSTEM32>\dllcache\osuninst.exe
<SYSTEM32>\dllcache\pathping.exe
<SYSTEM32>\dllcache\pinball.exe
<SYSTEM32>\dllcache\evntwin.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe
%WINDIR%\NOTEPAD.EXE
%WINDIR%\mui\muisetup.exe
%WINDIR%\pchealth\helpctr\binaries\notiflag.exe
%WINDIR%\pchealth\helpctr\binaries\HelpSvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe
%WINDIR%\Microsoft.NET\NETFXRepair.exe
%WINDIR%\msagent\agentsvr.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
<SYSTEM32>\at.exe
<SYSTEM32>\autofmt.exe
<SYSTEM32>\autolfn.exe
<SYSTEM32>\blastcln.exe
<SYSTEM32>\autochk.exe
<SYSTEM32>\auditusr.exe
%WINDIR%\system\WINSPOOL.DRV
<SYSTEM32>\autoconv.exe
<SYSTEM32>\bootvrfy.exe
<SYSTEM32>\charmap.exe
<SYSTEM32>\chkdsk.exe
<SYSTEM32>\cisvc.exe
<SYSTEM32>\chkntfs.exe
<SYSTEM32>\bootok.exe
<SYSTEM32>\bootcfg.exe
<SYSTEM32>\cacls.exe
<SYSTEM32>\calc.exe
%WINDIR%\regedit.exe
%WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe
%WINDIR%\sleep.exe
%WINDIR%\sfk.exe
%WINDIR%\pchealth\helpctr\binaries\HelpHost.exe
%WINDIR%\pchealth\helpctr\binaries\HelpCtr.exe
%WINDIR%\pchealth\helpctr\binaries\msconfig.exe
%WINDIR%\pchealth\helpctr\binaries\HscUpd.exe
<SYSTEM32>\actmovie.exe
<SYSTEM32>\asr_ldm.exe
<SYSTEM32>\attrib.exe
<SYSTEM32>\asr_fmt.exe
<SYSTEM32>\asr_pfu.exe
<SYSTEM32>\ahui.exe
<SYSTEM32>\accwiz.exe
<SYSTEM32>\atmadm.exe
<SYSTEM32>\arp.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\NETFXSBS10.exe
%WINDIR%\inf\unregmp2.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInUtil.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\csc.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
<SYSTEM32>\dllcache\conime.exe
<SYSTEM32>\dllcache\convlog.exe
<SYSTEM32>\dllcache\convert.exe
<SYSTEM32>\dllcache\ctfmon.exe
<SYSTEM32>\dllcache\comrepl.exe
<SYSTEM32>\dllcache\comrereg.exe
<SYSTEM32>\dllcache\clipsrv.exe
<SYSTEM32>\dllcache\cmdl32.exe
<SYSTEM32>\dllcache\control.exe
<SYSTEM32>\dllcache\dcomcnfg.exe
<SYSTEM32>\dllcache\ddeshare.exe
<SYSTEM32>\dllcache\dialer.exe
<SYSTEM32>\dllcache\dfrgfat.exe
<SYSTEM32>\dllcache\cscript.exe
<SYSTEM32>\dllcache\cprofile.exe
<SYSTEM32>\dllcache\cplexe.exe
<SYSTEM32>\dllcache\csrss.exe
<SYSTEM32>\dllcache\cisvc.exe
<SYSTEM32>\dllcache\cintsetp.exe
<SYSTEM32>\dllcache\cidaemon.exe
<SYSTEM32>\dllcache\classpnp.sys
<SYSTEM32>\dllcache\chkntfs.exe
<SYSTEM32>\dllcache\chgusr.exe
<SYSTEM32>\dllcache\cipher.exe
<SYSTEM32>\dllcache\chkrzm.exe
<SYSTEM32>\dllcache\ckcnv.exe
<SYSTEM32>\dllcache\cmmon32.exe
<SYSTEM32>\dllcache\compact.exe
<SYSTEM32>\dllcache\conf.exe
<SYSTEM32>\dllcache\cmstp.exe
<SYSTEM32>\dllcache\cmd.exe
<SYSTEM32>\dllcache\cleanmgr.exe
<SYSTEM32>\dllcache\clipbrd.exe
<SYSTEM32>\dllcache\comp.exe
<SYSTEM32>\dllcache\dvdupgrd.exe
<SYSTEM32>\dllcache\dxdiag.exe
<SYSTEM32>\dllcache\dxgthk.sys
<SYSTEM32>\dllcache\dwwin.exe
<SYSTEM32>\dllcache\dpnsvr.exe
<SYSTEM32>\dllcache\dpvsetup.exe
<SYSTEM32>\dllcache\dumprep.exe
<SYSTEM32>\dllcache\drvqry.exe
<SYSTEM32>\dllcache\esentutl.exe
<SYSTEM32>\dllcache\eventvwr.exe
<SYSTEM32>\dllcache\evntcmd.exe
<SYSTEM32>\dllcache\explorer.exe
<SYSTEM32>\dllcache\evtrig.exe
<SYSTEM32>\dllcache\evcreate.exe
<SYSTEM32>\dllcache\dxapi.sys
<SYSTEM32>\dllcache\et4000.sys
<SYSTEM32>\dllcache\eudcedit.exe
<SYSTEM32>\dllcache\dmboot.sys
<SYSTEM32>\dllcache\diskpart.exe
<SYSTEM32>\dllcache\dllhst3g.exe
<SYSTEM32>\dllcache\diantz.exe
<SYSTEM32>\dllcache\dfrgntfs.exe
<SYSTEM32>\dllcache\davcdata.exe
<SYSTEM32>\dllcache\diskdump.sys
<SYSTEM32>\dllcache\defrag.exe
<SYSTEM32>\dllcache\diskperf.exe
<SYSTEM32>\dllcache\dmadmin.exe
<SYSTEM32>\dllcache\doskey.exe
<SYSTEM32>\dllcache\drwtsn32.exe
<SYSTEM32>\dllcache\dplaysvr.exe
<SYSTEM32>\dllcache\dllhost.exe
<SYSTEM32>\dllcache\dmio.sys
<SYSTEM32>\dllcache\dmremote.exe
<SYSTEM32>\dllcache\dmload.sys
<SYSTEM32>\diantz.exe
<SYSTEM32>\dfrgfat.exe
<SYSTEM32>\dllcache\accwiz.exe
<SYSTEM32>\dllcache\afd.sys
<SYSTEM32>\dcomcnfg.exe
<SYSTEM32>\ddeshare.exe
<SYSTEM32>\dfrgntfs.exe
<SYSTEM32>\defrag.exe
<SYSTEM32>\dllcache\admin.exe
<SYSTEM32>\dllcache\ahui.exe
<SYSTEM32>\diskpart.exe
<SYSTEM32>\dllcache\asyncmac.sys
<SYSTEM32>\dllcache\asr_pfu.exe
<SYSTEM32>\dllcache\alg.exe
<SYSTEM32>\dllcache\actmovie.exe
<SYSTEM32>\diskperf.exe
<SYSTEM32>\dllcache\agentsvr.exe
<SYSTEM32>\cleanmgr.exe
<SYSTEM32>\clipbrd.exe
<SYSTEM32>\cmmon32.exe
<SYSTEM32>\cliconfg.exe
<SYSTEM32>\ckcnv.exe
<SYSTEM32>\cidaemon.exe
<SYSTEM32>\cipher.exe
<SYSTEM32>\clipsrv.exe
<SYSTEM32>\cmdl32.exe
<SYSTEM32>\conime.exe
<SYSTEM32>\comp.exe
<SYSTEM32>\convert.exe
<SYSTEM32>\control.exe
<SYSTEM32>\cmstp.exe
<SYSTEM32>\Com\comrereg.exe
<SYSTEM32>\compact.exe
<SYSTEM32>\Com\comrepl.exe
<SYSTEM32>\dllcache\bridge.sys
<SYSTEM32>\dllcache\bootok.exe
<SYSTEM32>\dllcache\calc.exe
<SYSTEM32>\dllcache\cacls.exe
<SYSTEM32>\dllcache\beep.sys
<SYSTEM32>\dllcache\bckgzm.exe
<SYSTEM32>\dllcache\bootvrfy.exe
<SYSTEM32>\dllcache\bootcfg.exe
<SYSTEM32>\dllcache\cdfs.sys
<SYSTEM32>\dllcache\change.exe
<SYSTEM32>\dllcache\cap7146.sys
<SYSTEM32>\dllcache\chgport.exe
<SYSTEM32>\dllcache\chkdsk.exe
<SYSTEM32>\dllcache\cfgwiz.exe
<SYSTEM32>\dllcache\charmap.exe
<SYSTEM32>\dllcache\cb32.exe
<SYSTEM32>\dllcache\chglogon.exe
<SYSTEM32>\dllcache\atmadm.exe
<SYSTEM32>\dllcache\at.exe
<SYSTEM32>\dllcache\atmarpc.sys
<SYSTEM32>\dllcache\attrib.exe
<SYSTEM32>\dllcache\asr_ldm.exe
<SYSTEM32>\dllcache\arp.exe
<SYSTEM32>\dllcache\atmuni.sys
<SYSTEM32>\dllcache\asr_fmt.exe
<SYSTEM32>\dllcache\atmepvc.sys
<SYSTEM32>\dllcache\author.exe
<SYSTEM32>\dllcache\autolfn.exe
<SYSTEM32>\dllcache\blastcln.exe
<SYSTEM32>\dllcache\auditusr.exe
<SYSTEM32>\dllcache\autochk.exe
<SYSTEM32>\dllcache\autoconv.exe
<SYSTEM32>\dllcache\atmlane.sys
<SYSTEM32>\dllcache\autofmt.exe
<SYSTEM32>\dllcache\shmgrate.exe
<SYSTEM32>\ntoskrnl.exe
<SYSTEM32>\net1.exe
<SYSTEM32>\ntbackup.exe
<SYSTEM32>\netdde.exe
<SYSTEM32>\narrator.exe
<SYSTEM32>\nbtstat.exe
<SYSTEM32>\nddeapir.exe
<SYSTEM32>\net.exe
<SYSTEM32>\ntkrnlpa.exe
<SYSTEM32>\nslookup.exe
<SYSTEM32>\netsetup.exe
<SYSTEM32>\ntsd.exe
<SYSTEM32>\ntvdm.exe
<SYSTEM32>\netstat.exe
<SYSTEM32>\notepad.exe
<SYSTEM32>\npp\nppagent.exe
<SYSTEM32>\netsh.exe
<SYSTEM32>\msacm32.drv
<SYSTEM32>\mqsvc.exe
<SYSTEM32>\msh261.drv
<SYSTEM32>\msh263.drv
<SYSTEM32>\mpnotify.exe
<SYSTEM32>\mqbkup.exe
<SYSTEM32>\mrinfo.exe
<SYSTEM32>\mqtgsvc.exe
<SYSTEM32>\mshta.exe
<SYSTEM32>\mstsc.exe
<SYSTEM32>\mstinit.exe
<SYSTEM32>\msiexec.exe
<SYSTEM32>\msswchx.exe
<SYSTEM32>\msdtc.exe
<SYSTEM32>\mspaint.exe
<SYSTEM32>\mshearts.exe
<SYSTEM32>\msg.exe
<SYSTEM32>\rasautou.exe
<SYSTEM32>\PresentationHost.exe
<SYSTEM32>\rasdial.exe
<SYSTEM32>\qwinsta.exe
<SYSTEM32>\qappsrv.exe
<SYSTEM32>\proquota.exe
<SYSTEM32>\qprocess.exe
<SYSTEM32>\proxycfg.exe
<SYSTEM32>\rcp.exe
<SYSTEM32>\recover.exe
<SYSTEM32>\rdsaddin.exe
<SYSTEM32>\regsvr32.exe
<SYSTEM32>\reg.exe
<SYSTEM32>\rcimlby.exe
<SYSTEM32>\rdpclip.exe
<SYSTEM32>\rdshost.exe
<SYSTEM32>\rasphone.exe
<SYSTEM32>\osk.exe
<SYSTEM32>\oobe\oobebaln.exe
<SYSTEM32>\pathping.exe
<SYSTEM32>\osuninst.exe
<SYSTEM32>\odbcad32.exe
<SYSTEM32>\nwscript.exe
<SYSTEM32>\oobe\msoobe.exe
<SYSTEM32>\odbcconf.exe
<SYSTEM32>\packager.exe
<SYSTEM32>\progman.exe
<SYSTEM32>\print.exe
<SYSTEM32>\ping6.exe
<SYSTEM32>\powercfg.exe
<SYSTEM32>\pentnt.exe
<SYSTEM32>\openfiles.exe
<SYSTEM32>\ping.exe
<SYSTEM32>\perfmon.exe
<SYSTEM32>\find.exe
<SYSTEM32>\fc.exe
<SYSTEM32>\eventcreate.exe
<SYSTEM32>\findstr.exe
<SYSTEM32>\eventvwr.exe
<SYSTEM32>\eudcedit.exe
<SYSTEM32>\expand.exe
<SYSTEM32>\extrac32.exe
<SYSTEM32>\eventtriggers.exe
<SYSTEM32>\forcedos.exe
<SYSTEM32>\fsquirt.exe
<SYSTEM32>\getmac.exe
<SYSTEM32>\fltMc.exe
<SYSTEM32>\fontview.exe
<SYSTEM32>\finger.exe
<SYSTEM32>\freecell.exe
<SYSTEM32>\ftp.exe
<DRIVERS>\volsnap.sys
<DRIVERS>\ws2ifsl.sys
<DRIVERS>\wanarp.sys
<DRIVERS>\wmilib.sys
<DRIVERS>\vdmindvd.sys
<DRIVERS>\videoprt.sys
<DRIVERS>\usbintel.sys
<DRIVERS>\vga.sys
<DRIVERS>\xxhgfs.sys
<SYSTEM32>\dwwin.exe
<SYSTEM32>\dvdplay.exe
<SYSTEM32>\esentutl.exe
<SYSTEM32>\dvdupgrd.exe
<SYSTEM32>\dxdiag.exe
<DRIVERS>\xrwebvirtnet.sys
<SYSTEM32>\dumprep.exe
<SYSTEM32>\drwtsn32.exe
<SYSTEM32>\lpq.exe
<SYSTEM32>\mmc.exe
<SYSTEM32>\logoff.exe
<SYSTEM32>\logagent.exe
<SYSTEM32>\lodctr.exe
<SYSTEM32>\lnkstub.exe
<SYSTEM32>\logonui.exe
<SYSTEM32>\lights.exe
<SYSTEM32>\magnify.exe
<SYSTEM32>\mountvol.exe
<SYSTEM32>\mnmsrvc.exe
<SYSTEM32>\mplay32.exe
<SYSTEM32>\mobsync.exe
<SYSTEM32>\lpr.exe
<SYSTEM32>\makecab.exe
<SYSTEM32>\migpwd.exe
<SYSTEM32>\logman.exe
<SYSTEM32>\gpupdate.exe
<SYSTEM32>\grpconv.exe
<SYSTEM32>\hostname.exe
<SYSTEM32>\icardagt.exe
<SYSTEM32>\gpresult.exe
<SYSTEM32>\fixmapi.exe
<SYSTEM32>\help.exe
<SYSTEM32>\fsutil.exe
<SYSTEM32>\ipsec6.exe
<SYSTEM32>\ipxroute.exe
<SYSTEM32>\ipconfig.exe
<SYSTEM32>\locator.exe
<SYSTEM32>\label.exe
<SYSTEM32>\ipv6.exe
<SYSTEM32>\iexpress.exe
<SYSTEM32>\ie4uinit.exe
<SYSTEM32>\imapi.exe
<SYSTEM32>\usrmlnka.exe
<SYSTEM32>\utilman.exe
<SYSTEM32>\vssvc.exe
<SYSTEM32>\vssadmin.exe
<SYSTEM32>\usmt\migwiz.exe
<SYSTEM32>\usmt\migwiz_a.exe
<SYSTEM32>\wbem\scrcons.exe
<SYSTEM32>\URTTEMP\regtlib.exe
<SYSTEM32>\verifier.exe
<SYSTEM32>\wbem\wmic.exe
<SYSTEM32>\wbem\wbemtest.exe
<SYSTEM32>\wbem\winmgmt.exe
<SYSTEM32>\wbem\wmiadap.exe
<SYSTEM32>\usrshuta.exe
<SYSTEM32>\wbem\unsecapp.exe
<SYSTEM32>\wbem\mofcomp.exe
<SYSTEM32>\usrprbda.exe
<SYSTEM32>\tscon.exe
<SYSTEM32>\tscupgrd.exe
<SYSTEM32>\tourstart.exe
<SYSTEM32>\tsdiscon.exe
<SYSTEM32>\taskman.exe
<SYSTEM32>\tlntsvr.exe
<SYSTEM32>\tracert6.exe
<SYSTEM32>\tracert.exe
<SYSTEM32>\tskill.exe
<SYSTEM32>\TsWpfWrp.exe
<SYSTEM32>\usmt\migload.exe
<SYSTEM32>\userinit.exe
<SYSTEM32>\ups.exe
<SYSTEM32>\upnpcont.exe
<SYSTEM32>\unlodctr.exe
<SYSTEM32>\typeperf.exe
<SYSTEM32>\tsshutdn.exe
%WINDIR%\twunk_32.exe
%WINDIR%\TASKMAN.EXE
%WINDIR%\XXInstall\cmdow.exe
%WINDIR%\XXInstall\devcon.exe
<SYSTEM32>\wuauclt.exe
<SYSTEM32>\wscript.exe
<SYSTEM32>\xcopy.exe
<SYSTEM32>\XPSViewer\XPSViewer.exe
%WINDIR%\XXInstall\exdir.exe
%WINDIR%\XXInstall\vminstall.exe
%WINDIR%\XXInstall\screen.exe
%WINDIR%\winhlp32.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
%WINDIR%\XXInstall\Scripts\antivm.exe
%WINDIR%\XXInstall\events.exe
%WINDIR%\XXInstall\ps.exe
%WINDIR%\XXInstall\hashdeep.exe
<SYSTEM32>\wiaacmgr.exe
<SYSTEM32>\wdmaud.drv
<SYSTEM32>\winmsd.exe
<SYSTEM32>\winhlp32.exe
<SYSTEM32>\wbem\wmiapsrv.exe
<SYSTEM32>\watchdog.sys
<SYSTEM32>\wextract.exe
<SYSTEM32>\w32tm.exe
<SYSTEM32>\winver.exe
<SYSTEM32>\write.exe
<SYSTEM32>\wpnpinst.exe
<SYSTEM32>\wuauclt1.exe
<SYSTEM32>\wupdmgr.exe
<SYSTEM32>\wpabaln.exe
<SYSTEM32>\winchat.exe
<SYSTEM32>\wscntfy.exe
<SYSTEM32>\winmine.exe
<SYSTEM32>\scardsvr.exe
<SYSTEM32>\runonce.exe
<SYSTEM32>\schtasks.exe
<SYSTEM32>\rwinsta.exe
<SYSTEM32>\runas.exe
<SYSTEM32>\rsopprov.exe
<SYSTEM32>\rsvp.exe
<SYSTEM32>\rundll32.exe
<SYSTEM32>\savedump.exe
<SYSTEM32>\sethc.exe
<SYSTEM32>\sessmgr.exe
<SYSTEM32>\sfc.exe
<SYSTEM32>\shadow.exe
<SYSTEM32>\sdbinst.exe
<SYSTEM32>\sc.exe
<SYSTEM32>\setup.exe
<SYSTEM32>\secedit.exe
<SYSTEM32>\replace.exe
<SYSTEM32>\reset.exe
<SYSTEM32>\Restore\srdiag.exe
<SYSTEM32>\relog.exe
<SYSTEM32>\regini.exe
<SYSTEM32>\regwiz.exe
<SYSTEM32>\Restore\rstrui.exe
<SYSTEM32>\regedt32.exe
<SYSTEM32>\route.exe
<SYSTEM32>\rsmsink.exe
<SYSTEM32>\rsmui.exe
<SYSTEM32>\rsnotify.exe
<SYSTEM32>\rtcshare.exe
<SYSTEM32>\routemon.exe
<SYSTEM32>\rexec.exe
<SYSTEM32>\rsm.exe
<SYSTEM32>\rsh.exe
<SYSTEM32>\systray.exe
<SYSTEM32>\sysocmgr.exe
<SYSTEM32>\tcpsvcs.exe
<SYSTEM32>\taskmgr.exe
<SYSTEM32>\sprestrt.exe
<SYSTEM32>\spupdsvc.exe
<SYSTEM32>\syskey.exe
<SYSTEM32>\stimon.exe
<SYSTEM32>\systeminfo.exe
<SYSTEM32>\telnet.exe
<SYSTEM32>\tracerpt.exe
<SYSTEM32>\tlntsess.exe
<SYSTEM32>\tlntadmn.exe
<SYSTEM32>\taskkill.exe
<SYSTEM32>\tcmsetup.exe
<SYSTEM32>\tasklist.exe
<SYSTEM32>\tftp.exe
<SYSTEM32>\smlogsvc.exe
<SYSTEM32>\smbinst.exe
<SYSTEM32>\sndrec32.exe
<SYSTEM32>\skeys.exe
<SYSTEM32>\sigverif.exe
<SYSTEM32>\shrpubw.exe
<SYSTEM32>\shutdown.exe
<SYSTEM32>\shmgrate.exe
<SYSTEM32>\sol.exe
<SYSTEM32>\spnpinst.exe
<SYSTEM32>\spiisupd.exe
<SYSTEM32>\subst.exe
<SYSTEM32>\syncapp.exe
<SYSTEM32>\sort.exe
<SYSTEM32>\sndvol32.exe
<SYSTEM32>\spider.exe
<SYSTEM32>\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
<DRIVERS>\update.sys
<SYSTEM32>\dllcache\winchat.exe
<SYSTEM32>\dllcache\weitekp9.sys
<SYSTEM32>\dllcache\winmgmt.exe
<SYSTEM32>\dllcache\wb32.exe
<SYSTEM32>\dllcache\wiaacmgr.exe
<SYSTEM32>\dllcache\watchdog.sys
<SYSTEM32>\dllcache\win32k.sys
<SYSTEM32>\dllcache\winlogon.exe
<SYSTEM32>\dllcache\winmine.exe
<SYSTEM32>\dllcache\wmilib.sys
<SYSTEM32>\dllcache\wmiadap.exe
<SYSTEM32>\dllcache\wmic.exe
<SYSTEM32>\dllcache\wuauclt.exe
<SYSTEM32>\dllcache\winspool.drv
<SYSTEM32>\dllcache\winhstb.exe
<SYSTEM32>\dllcache\wmiapsrv.exe
<SYSTEM32>\dllcache\winmsd.exe
<SYSTEM32>\dllcache\volsnap.sys
<SYSTEM32>\dllcache\userinit.exe
<SYSTEM32>\dllcache\vssvc.exe
<SYSTEM32>\dllcache\verifier.exe
<SYSTEM32>\dllcache\update.sys
<SYSTEM32>\dllcache\uploadm.exe
<SYSTEM32>\dllcache\usb8023.sys
<SYSTEM32>\dllcache\utilman.exe
<SYSTEM32>\dllcache\vga.sys
<SYSTEM32>\dllcache\wbemtest.exe
<SYSTEM32>\dllcache\wanarp.sys
<SYSTEM32>\dllcache\wabmig.exe
<SYSTEM32>\dllcache\wextract.exe
<SYSTEM32>\dllcache\vssadmin.exe
<SYSTEM32>\dllcache\videoprt.sys
<SYSTEM32>\dllcache\wab.exe
<SYSTEM32>\dllcache\w32tm.exe
<DRIVERS>\amdk7.sys
<SYSTEM32>\dmadmin.exe
<SYSTEM32>\doskey.exe
<DRIVERS>\amdk6.sys
<DRIVERS>\acpiec.sys
<SYSTEM32>\dmremote.exe
<DRIVERS>\AGP440.SYS
<DRIVERS>\afd.sys
<DRIVERS>\atapi.sys
<SYSTEM32>\driverquery.exe
<SYSTEM32>\dplaysvr.exe
<DRIVERS>\atmarpc.sys
<DRIVERS>\audstub.sys
<DRIVERS>\atmepvc.sys
<DRIVERS>\asyncmac.sys
<DRIVERS>\atmuni.sys
<DRIVERS>\arp1394.sys
<SYSTEM32>\dllcache\wpnpinst.exe
<SYSTEM32>\dllcache\wmiprvse.exe
<SYSTEM32>\dllcache\wupdmgr.exe
<SYSTEM32>\dllcache\wmplayer.exe
<SYSTEM32>\dllcache\write.exe
<SYSTEM32>\dllcache\wordpad.exe
<SYSTEM32>\dllcache\wpabaln.exe
<SYSTEM32>\dllcache\winver.exe
<SYSTEM32>\dllcache\wscntfy.exe
<SYSTEM32>\dllhost.exe
<SYSTEM32>\dllcache\xcopy.exe
<DRIVERS>\acpi.sys
<SYSTEM32>\dllhst3g.exe
<SYSTEM32>\dllcache\ws2ifsl.sys
<SYSTEM32>\dllcache\wscript.exe
<SYSTEM32>\dllcache\zclientm.exe
<SYSTEM32>\dllcache\wuauclt1.exe
<SYSTEM32>\dllcache\syskey.exe
<SYSTEM32>\dllcache\subst.exe
<SYSTEM32>\dllcache\systray.exe
<SYSTEM32>\dllcache\sysinfo.exe
<SYSTEM32>\dllcache\sprestrt.exe
<SYSTEM32>\dllcache\syncapp.exe
<SYSTEM32>\dllcache\svchost.exe
<SYSTEM32>\dllcache\stimon.exe
<SYSTEM32>\dllcache\sysocmgr.exe
<SYSTEM32>\dllcache\tcpip6.sys
<SYSTEM32>\dllcache\tasklist.exe
<SYSTEM32>\dllcache\taskman.exe
<SYSTEM32>\dllcache\tdasync.sys
<SYSTEM32>\dllcache\tape.sys
<SYSTEM32>\dllcache\taskmgr.exe
<SYSTEM32>\dllcache\tcpip.sys
<SYSTEM32>\dllcache\taskkill.exe
<SYSTEM32>\dllcache\sndvol32.exe
<SYSTEM32>\dllcache\sigverif.exe
<SYSTEM32>\dllcache\snmp.exe
<SYSTEM32>\dllcache\snmptrap.exe
<SYSTEM32>\dllcache\smi2smir.exe
<SYSTEM32>\dllcache\shtml.exe
<SYSTEM32>\dllcache\smlogsvc.exe
<SYSTEM32>\dllcache\sndrec32.exe
<SYSTEM32>\dllcache\sol.exe
<SYSTEM32>\dllcache\srv.sys
<SYSTEM32>\dllcache\srdiag.exe
<SYSTEM32>\dllcache\sr.sys
<SYSTEM32>\dllcache\spoolsv.exe
<SYSTEM32>\dllcache\spider.exe
<SYSTEM32>\dllcache\sort.exe
<SYSTEM32>\dllcache\spnpinst.exe
<SYSTEM32>\dllcache\spiisupd.exe
<SYSTEM32>\dllcache\tskill.exe
<SYSTEM32>\dllcache\tsprof.exe
<SYSTEM32>\dllcache\tsdiscon.exe
<SYSTEM32>\dllcache\tracert6.exe
<SYSTEM32>\dllcache\tlntsvr.exe
<SYSTEM32>\dllcache\tlntadmn.exe
<SYSTEM32>\dllcache\tracert.exe
<SYSTEM32>\dllcache\tscupgrd.exe
<SYSTEM32>\dllcache\tsshutdn.exe
<SYSTEM32>\dllcache\ups.exe
<SYSTEM32>\dllcache\unregmp2.exe
<SYSTEM32>\dllcache\unsecapp.exe
<SYSTEM32>\dllcache\upnpcont.exe
<SYSTEM32>\dllcache\typeperf.exe
<SYSTEM32>\dllcache\udfs.sys
<SYSTEM32>\dllcache\unlodctr.exe
<SYSTEM32>\dllcache\twunk_32.exe
<SYSTEM32>\dllcache\tourW.exe
<SYSTEM32>\dllcache\tdipx.sys
<SYSTEM32>\dllcache\telnet.exe
<SYSTEM32>\dllcache\tdtcp.sys
<SYSTEM32>\dllcache\tcptest.exe
<SYSTEM32>\dllcache\tcmsetup.exe
<SYSTEM32>\dllcache\tdpipe.sys
<SYSTEM32>\dllcache\tcpsvcs.exe
<SYSTEM32>\dllcache\tftp.exe
<SYSTEM32>\dllcache\tracerpt.exe
<SYSTEM32>\dllcache\tourstrt.exe
<SYSTEM32>\dllcache\tscon.exe
<SYSTEM32>\dllcache\tlntsess.exe
<SYSTEM32>\dllcache\tdspx.sys
<SYSTEM32>\dllcache\tdi.sys
<SYSTEM32>\dllcache\tintsetp.exe
<SYSTEM32>\dllcache\tintlphr.exe
<DRIVERS>\pci.sys
<DRIVERS>\raspti.sys
<DRIVERS>\processr.sys
<DRIVERS>\psched.sys
<DRIVERS>\rasacd.sys
<DRIVERS>\pcmcia.sys
<DRIVERS>\pciidex.sys
<DRIVERS>\parvdm.sys
<DRIVERS>\ptilink.sys
<DRIVERS>\rdpcdd.sys
<DRIVERS>\rdpdr.sys
<DRIVERS>\redbook.sys
<DRIVERS>\raspppoe.sys
<DRIVERS>\rawwan.sys
<DRIVERS>\raspptp.sys
<DRIVERS>\rasl2tp.sys
<DRIVERS>\rdbss.sys
<DRIVERS>\nmnt.sys
<DRIVERS>\nikedrv.sys
<DRIVERS>\null.sys
<DRIVERS>\nwlnkflt.sys
<DRIVERS>\netbios.sys
<DRIVERS>\ntfs.sys
<DRIVERS>\npfs.sys
<DRIVERS>\netbt.sys
<DRIVERS>\nwrdr.sys
<DRIVERS>\parport.sys
<DRIVERS>\nwlnkipx.sys
<DRIVERS>\partmgr.sys
<DRIVERS>\oprghdlr.sys
<DRIVERS>\nwlnknb.sys
<DRIVERS>\nwlnkspx.sys
<DRIVERS>\nwlnkfwd.sys
<DRIVERS>\p3.sys
<DRIVERS>\tcpip6.sys
<DRIVERS>\tape.sys
<DRIVERS>\tdtcp.sys
<DRIVERS>\tdi.sys
<DRIVERS>\stream.sys
<DRIVERS>\sr.sys
<DRIVERS>\tcpip.sys
<DRIVERS>\swenum.sys
<DRIVERS>\tosdvd.sys
<DRIVERS>\usb8023.sys
<DRIVERS>\tunmp.sys
<DRIVERS>\usbcamd2.sys
<DRIVERS>\usbcamd.sys
<DRIVERS>\termdd.sys
<DRIVERS>\tdpipe.sys
<DRIVERS>\tsbvcap.sys
<DRIVERS>\udfs.sys
<DRIVERS>\rootmdm.sys
<DRIVERS>\rndismp.sys
<DRIVERS>\scsiport.sys
<DRIVERS>\sdbus.sys
<DRIVERS>\rio8drv.sys
<DRIVERS>\rdpwd.sys
<DRIVERS>\RMCast.sys
<DRIVERS>\riodrv.sys
<DRIVERS>\secdrv.sys
<DRIVERS>\sfloppy.sys
<DRIVERS>\sffdisk.sys
<DRIVERS>\sffp_sd.sys
<DRIVERS>\smclib.sys
<DRIVERS>\serenum.sys
<DRIVERS>\srv.sys
<DRIVERS>\sonydcam.sys
<DRIVERS>\serial.sys
<DRIVERS>\dxgthk.sys
<DRIVERS>\dmio.sys
<DRIVERS>\eventmon.sys
<DRIVERS>\dxapi.sys
<DRIVERS>\DbgPrnHk.sys
<DRIVERS>\classpnp.sys
<DRIVERS>\dmload.sys
<DRIVERS>\diskdump.sys
<DRIVERS>\fastfat.sys
<DRIVERS>\intelide.sys
<DRIVERS>\fltMgr.sys
<DRIVERS>\flpydisk.sys
<DRIVERS>\fsvga.sys
<DRIVERS>\fips.sys
<DRIVERS>\fdc.sys
<DRIVERS>\imapi.sys
<DRIVERS>\filedisk.sys
<DRIVERS>\cinemst2.sys
<DRIVERS>\bridge.sys
<DRIVERS>\beep.sys
<DRIVERS>\cdaudio.sys
<SYSTEM32>\dpnsvr.exe
<DRIVERS>\atmlane.sys
<DRIVERS>\battc.sys
<SYSTEM32>\dpvsetup.exe
<DRIVERS>\CmBatt.sys
<DRIVERS>\dmboot.sys
<DRIVERS>\compbatt.sys
<DRIVERS>\cpqdap01.sys
<DRIVERS>\disk.sys
<DRIVERS>\crusoe.sys
<DRIVERS>\cbidf2k.sys
<DRIVERS>\cdfs.sys
<DRIVERS>\cdrom.sys
<DRIVERS>\msfs.sys
<DRIVERS>\mrxsmb.sys
<DRIVERS>\mouclass.sys
<DRIVERS>\mssmbios.sys
<DRIVERS>\mountmgr.sys
<DRIVERS>\mcd.sys
<DRIVERS>\mrxdav.sys
<DRIVERS>\mf.sys
<DRIVERS>\ndistapi.sys
<DRIVERS>\ndiswan.sys
<DRIVERS>\ndisuio.sys
<DRIVERS>\nic1394.sys
<DRIVERS>\ndproxy.sys
<DRIVERS>\mup.sys
<DRIVERS>\msgpc.sys
<DRIVERS>\ndis.sys
<DRIVERS>\mqac.sys
<DRIVERS>\ip6fw.sys
<DRIVERS>\fs_rec.sys
<DRIVERS>\ipinip.sys
<DRIVERS>\ipnat.sys
<DRIVERS>\i8042prt.sys
<DRIVERS>\http.sys
<DRIVERS>\ftdisk.sys
<DRIVERS>\intelppm.sys
<DRIVERS>\ipsec.sys
<DRIVERS>\ksecdd.sys
<DRIVERS>\isapnp.sys
<DRIVERS>\modem.sys
<DRIVERS>\mnmdd.sys
<DRIVERS>\ks.sys
<DRIVERS>\ipfltdrv.sys
<DRIVERS>\irenum.sys
<DRIVERS>\kbdclass.sys

Модифицирует главную загрузочную запись (MBR).

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\wbem\mofcomp.exe.new
<SYSTEM32>\usmt\migwiz.exe.new
<SYSTEM32>\usmt\migwiz_a.exe.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%WINDIR%\twunk_32.exe.new
%WINDIR%\taskman.exe.new
%WINDIR%\twunk_16.exe.new

Удаляет следующие файлы:

%WINDIR%\mui\muisetup.exe
%WINDIR%\ocx\mscdrun.inf
%WINDIR%\ocx\mci32.inf
%WINDIR%\ocx\msadodc.inf
%WINDIR%\ocx\mscomctl.inf
%WINDIR%\ocx\mscomct2.inf
%WINDIR%\NOTEPAD.EXE
%WINDIR%\ocx\dblist32.inf
%WINDIR%\ocx\msaddndr.inf
%WINDIR%\ocx\comdlg32.inf
%WINDIR%\ocx\comctl32.inf
%WINDIR%\ocx\msbind.inf
%WINDIR%\ocx\mschrt20.inf
%WINDIR%\ocx\dbgrid32.inf
%WINDIR%\msdfmap.ini
%WINDIR%\ocx\dbadapt.inf
%WINDIR%\ocx\msrdc20.inf
%WINDIR%\ocx\mshtmpgr.inf
%WINDIR%\ocx\msrdo20.inf
%WINDIR%\ocx\msinet.inf
%WINDIR%\ocx\msstkprp.inf
%WINDIR%\ocx\msmask32.inf
%WINDIR%\ocx\msmapi32.inf
%WINDIR%\ocx\msstdfmt.inf
%WINDIR%\ocx\msdatlst.inf
%WINDIR%\ocx\msdatrep.inf
%WINDIR%\ocx\mscomm32.inf
%WINDIR%\ocx\msdatgrd.inf
%WINDIR%\ocx\MSDBRpt.inf
%WINDIR%\ocx\MSHTMPGD.inf
%WINDIR%\ocx\MSFlxGrd.inf
%WINDIR%\ocx\msdbrptr.inf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\_DataOracleClientPerfCounters_shared12_neutral.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\_Networkingperfcounters.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\_ServiceModelOperationPerfCounters.ini
%WINDIR%\msagent\agentsvr.exe
%WINDIR%\ocx\comct232.inf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\_ServiceModelServicePerfCounters.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\_SMSvcHostPerfCounters.ini
%WINDIR%\Microsoft.NET\NETFXRepair.exe
%WINDIR%\ocx\comct332.inf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\_TransactionBridgePerfCounters.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Extended\ParameterInfo.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Strings.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Extended\UiInfo.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\_Networkingperfcounters_v2.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\_ServiceModelEndpointPerfCounters.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\_dataperfcounters_shared12_neutral.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\_DataPerfCounters.ini
%WINDIR%\ocx\mshflxgd.inf
%WINDIR%\security\templates\securedc.inf
%WINDIR%\security\templates\setup security.inf
%WINDIR%\security\templates\rootsec.inf
%WINDIR%\srchasst\mui\0409\charchsr.xml
%WINDIR%\srchasst\mui\0409\inetsrch.xml
%WINDIR%\srchasst\mui\0409\inetfind.xml
%WINDIR%\srchasst\mui\0409\charctxt.xml
%WINDIR%\srchasst\mui\0409\error.xml
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\pssmachinesnapshot-less.xml
%WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\loc_strings.xml
%WINDIR%\pchealth\UploadLB\Config\config.xml
%WINDIR%\regedit.exe
%WINDIR%\security\templates\hisecws.inf
%WINDIR%\security\templates\compatws.inf
%WINDIR%\security\templates\hisecdc.inf
%WINDIR%\srchasst\mui\0409\lcladvmm.xml
%WINDIR%\srchasst\mui\0409\lcladvd.xml
%WINDIR%\sleep.exe
%WINDIR%\srchasst\mui\0409\finish.xml
%WINDIR%\srchasst\mui\0409\lcldate.xml
%WINDIR%\srchasst\mui\0409\lcldocs.xml
%WINDIR%\srchasst\mui\0409\lclcomp.xml
%WINDIR%\srchasst\mui\0409\lcladvdf.xml
%WINDIR%\srchasst\mui\0409\intents.xml
%WINDIR%\srchasst\mui\0409\indxsvc.xml
%WINDIR%\sfk.exe
%WINDIR%\srchasst\mui\0409\inetopts.xml
%WINDIR%\srchasst\mui\0409\lcladv.xml
%WINDIR%\security\templates\securews.inf
%WINDIR%\srchasst\mui\0409\intro.xml
%WINDIR%\srchasst\mui\0409\inetpref.xml
%WINDIR%\ocx\wbclsdsr.inf
%WINDIR%\ocx\sysinfo.inf
%WINDIR%\pchealth\helpctr\binaries\HelpHost.exe
%WINDIR%\pchealth\helpctr\binaries\HelpCtr.exe
%WINDIR%\pchealth\helpctr\Config\dataspec.xml
%WINDIR%\pchealth\helpctr\Config\sereg.xml
%WINDIR%\pchealth\helpctr\binaries\msconfig.exe
%WINDIR%\pchealth\helpctr\Config\SAFStore.xml
%WINDIR%\ocx\picclp32.inf
%WINDIR%\ocx\RichTx32.inf
%WINDIR%\ocx\mswcrun.inf
%WINDIR%\ocx\mswinsck.inf
%WINDIR%\pchealth\helpctr\binaries\notiflag.exe
%WINDIR%\pchealth\helpctr\binaries\HscUpd.exe
%WINDIR%\pchealth\helpctr\binaries\HelpSvc.exe
%WINDIR%\ocx\tabctl32.inf
%WINDIR%\pchealth\helpctr\System\Remote Assistance\RAClientLayout.xml
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\pssmachinesnapshot-wo-com.xml
%WINDIR%\pchealth\helpctr\System\sysinfo\msinfo.xml
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAToolBar.xml
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\pssmachinesnapshot.xml
%WINDIR%\repair\secsetup.inf
%WINDIR%\pchealth\helpctr\System\Remote Assistance\RAIMLayout.xml
%WINDIR%\pchealth\helpctr\System\Remote Assistance\RAURA.xml
%WINDIR%\pchealth\helpctr\System\DFS\viewmode.xml
%WINDIR%\Offline Web Pages\desktop.ini
%WINDIR%\ODBCINST.INI
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg
%WINDIR%\pchealth\helpctr\System\Remote Assistance\RAHelpeeAcceptLayout.xml
%WINDIR%\pchealth\helpctr\System\panels\MiniNavBar.xml
%WINDIR%\pchealth\helpctr\System\panels\NavBar.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_perf2.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_perf.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.2052.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1046.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.3082.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.2070.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1053.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state_perf.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\corperfmonsymbols.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInUtil.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1031.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1025.ini
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerfCounters.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\csc.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\_TransactionBridgePerfCounters.ini
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\_SMSvcHostPerfCounters.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1045.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1042.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1041.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1035.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1055.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1049.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1044.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1043.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1030.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1036.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1028.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1037.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1038.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1032.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1029.ini
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\locdata.1040.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Client\ParameterInfo.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Client\UiInfo.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Strings.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\NetFx40_IIS_schema_update.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\netmemorycache.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\PerfCounters.ini
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\LocalizedData.xml
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
<SYSTEM32>\dllcache\bootvrfy.exe
<SYSTEM32>\dllcache\bootok.exe
<SYSTEM32>\dllcache\beep.sys
<SYSTEM32>\dllcache\bootcfg.exe
<SYSTEM32>\dllcache\calc.exe
<SYSTEM32>\dllcache\chglogon.exe
<SYSTEM32>\dllcache\bridge.sys
<SYSTEM32>\dllcache\cacls.exe
<SYSTEM32>\dllcache\atmlane.sys
<SYSTEM32>\dllcache\author.exe
<SYSTEM32>\dllcache\autofmt.exe
<SYSTEM32>\dllcache\autochk.exe
<SYSTEM32>\dllcache\blastcln.exe
<SYSTEM32>\dllcache\bckgzm.exe
<SYSTEM32>\dllcache\auditusr.exe
<SYSTEM32>\dllcache\autolfn.exe
<SYSTEM32>\dllcache\chkntfs.exe
<SYSTEM32>\dllcache\cipher.exe
<SYSTEM32>\dllcache\chkdsk.exe
<SYSTEM32>\dllcache\chkrzm.exe
<SYSTEM32>\dllcache\ckcnv.exe
<SYSTEM32>\dllcache\cidaemon.exe
<SYSTEM32>\dllcache\cintsetp.exe
<SYSTEM32>\dllcache\cisvc.exe
<SYSTEM32>\dllcache\charmap.exe
<SYSTEM32>\dllcache\cfgwiz.exe
<SYSTEM32>\dllcache\cb32.exe
<SYSTEM32>\dllcache\cdfs.sys
<SYSTEM32>\dllcache\chgport.exe
<SYSTEM32>\dllcache\chgusr.exe
<SYSTEM32>\dllcache\cap7146.sys
<SYSTEM32>\dllcache\change.exe
<SYSTEM32>\DirectX\Dinput\mse_g.ini
<SYSTEM32>\dllcache\admin.exe
<SYSTEM32>\dllcache\afd.sys
<SYSTEM32>\DirectX\Dinput\msprw.ini
<SYSTEM32>\dllcache\agentsvr.exe
<SYSTEM32>\diskperf.exe
<SYSTEM32>\DirectX\Dinput\raiderpd.ini
<SYSTEM32>\diskpart.exe
<SYSTEM32>\DirectX\Dinput\ms7_g.ini
<SYSTEM32>\DirectX\Dinput\ms8_g.ini
<SYSTEM32>\DirectX\Dinput\ms56.ini
<SYSTEM32>\DirectX\Dinput\ms7.ini
<SYSTEM32>\DirectX\Dinput\msf1f.ini
<SYSTEM32>\dllcache\actmovie.exe
<SYSTEM32>\DirectX\Dinput\mse.ini
<SYSTEM32>\dllcache\accwiz.exe
<SYSTEM32>\dllcache\atmuni.sys
<SYSTEM32>\dllcache\atmadm.exe
<SYSTEM32>\dllcache\at.exe
<SYSTEM32>\dllcache\asr_fmt.exe
<SYSTEM32>\dllcache\atmarpc.sys
<SYSTEM32>\dllcache\autoconv.exe
<SYSTEM32>\dllcache\atmepvc.sys
<SYSTEM32>\dllcache\attrib.exe
<SYSTEM32>\dllcache\ahui.exe
<SYSTEM32>\dllcache\ansi.sys
<SYSTEM32>\dllcache\alg.exe
<SYSTEM32>\dllcache\append.exe
<SYSTEM32>\dllcache\arp.exe
<SYSTEM32>\dllcache\asr_ldm.exe
<SYSTEM32>\dllcache\asr_pfu.exe
<SYSTEM32>\dllcache\asyncmac.sys
<SYSTEM32>\dllcache\classpnp.sys
<SYSTEM32>\dllcache\dosx.exe
<SYSTEM32>\dllcache\dplaysvr.exe
<SYSTEM32>\dllcache\dmload.sys
<SYSTEM32>\dllcache\dmremote.exe
<SYSTEM32>\dllcache\dpvsetup.exe
<SYSTEM32>\dllcache\dpnsvr.exe
<SYSTEM32>\dllcache\drwtsn32.exe
<SYSTEM32>\dllcache\drwatson.exe
<SYSTEM32>\dllcache\diskperf.exe
<SYSTEM32>\dllcache\dmboot.sys
<SYSTEM32>\dllcache\diantz.exe
<SYSTEM32>\dllcache\diskpart.exe
<SYSTEM32>\dllcache\doskey.exe
<SYSTEM32>\dllcache\dmadmin.exe
<SYSTEM32>\dllcache\dmio.sys
<SYSTEM32>\dllcache\dllhost.exe
<SYSTEM32>\dllcache\edlin.exe
<SYSTEM32>\dllcache\et4000.sys
<SYSTEM32>\dllcache\eudcedit.exe
<SYSTEM32>\dllcache\evcreate.exe
<SYSTEM32>\dllcache\explorer.exe
<SYSTEM32>\dllcache\evtrig.exe
<SYSTEM32>\dllcache\eventvwr.exe
<SYSTEM32>\dllcache\evntcmd.exe
<SYSTEM32>\dllcache\dumprep.exe
<SYSTEM32>\dllcache\dxdiag.exe
<SYSTEM32>\dllcache\drvqry.exe
<SYSTEM32>\dllcache\dvdupgrd.exe
<SYSTEM32>\dllcache\dxapi.sys
<SYSTEM32>\dllcache\esentutl.exe
<SYSTEM32>\dllcache\dwwin.exe
<SYSTEM32>\dllcache\dxgthk.sys
<SYSTEM32>\dllcache\comrepl.exe
<SYSTEM32>\dllcache\clipsrv.exe
<SYSTEM32>\dllcache\comrereg.exe
<SYSTEM32>\dllcache\cmdl32.exe
<SYSTEM32>\dllcache\convert.exe
<SYSTEM32>\dllcache\control.exe
<SYSTEM32>\dllcache\country.sys
<SYSTEM32>\dllcache\conime.exe
<SYSTEM32>\dllcache\clipbrd.exe
<SYSTEM32>\dllcache\comp.exe
<SYSTEM32>\dllcache\cleanmgr.exe
<SYSTEM32>\dllcache\cmd.exe
<SYSTEM32>\dllcache\cmstp.exe
<SYSTEM32>\dllcache\compact.exe
<SYSTEM32>\dllcache\conf.exe
<SYSTEM32>\dllcache\cmmon32.exe
<SYSTEM32>\dllcache\defrag.exe
<SYSTEM32>\dllcache\dialer.exe
<SYSTEM32>\dllcache\debug.exe
<SYSTEM32>\dllcache\dfrgfat.exe
<SYSTEM32>\dllcache\diskdump.sys
<SYSTEM32>\dllcache\dllhst3g.exe
<SYSTEM32>\dllcache\davcdata.exe
<SYSTEM32>\dllcache\dfrgntfs.exe
<SYSTEM32>\dllcache\cprofile.exe
<SYSTEM32>\dllcache\cscript.exe
<SYSTEM32>\dllcache\convlog.exe
<SYSTEM32>\dllcache\ctfmon.exe
<SYSTEM32>\dllcache\dcomcnfg.exe
<SYSTEM32>\dllcache\ddeshare.exe
<SYSTEM32>\dllcache\csrss.exe
<SYSTEM32>\dllcache\cplexe.exe
<SYSTEM32>\blastcln.exe
<SYSTEM32>\bootvrfy.exe
<SYSTEM32>\at.exe
<SYSTEM32>\autolfn.exe
<SYSTEM32>\calc.exe
<SYSTEM32>\cacls.exe
<SYSTEM32>\bootcfg.exe
<SYSTEM32>\bootok.exe
%WINDIR%\system\WINSPOOL.DRV
<SYSTEM32>\asr_fmt.exe
<SYSTEM32>\autochk.exe
<SYSTEM32>\asr_pfu.exe
<SYSTEM32>\autofmt.exe
%WINDIR%\system.ini
<SYSTEM32>\autoconv.exe
<SYSTEM32>\auditusr.exe
<SYSTEM32>\clipbrd.exe
<SYSTEM32>\cmmon32.exe
<SYSTEM32>\cleanmgr.exe
<SYSTEM32>\cliconfg.exe
<SYSTEM32>\Com\comrereg.exe
<SYSTEM32>\Com\comrepl.exe
<SYSTEM32>\cmdl32.exe
<SYSTEM32>\cmd.exe
<SYSTEM32>\cisvc.exe
<SYSTEM32>\chkntfs.exe
<SYSTEM32>\chkdsk.exe
<SYSTEM32>\charmap.exe
<SYSTEM32>\clipsrv.exe
<SYSTEM32>\cipher.exe
<SYSTEM32>\ckcnv.exe
<SYSTEM32>\cidaemon.exe
%WINDIR%\srchasst\mui\0409\lclrfine.xml
%WINDIR%\system\MCISEQ.DRV
%WINDIR%\srchasst\mui\0409\lclsize.xml
%WINDIR%\system\KEYBOARD.DRV
%WINDIR%\srchasst\mui\0409\lclsrch.xml
%WINDIR%\system\MOUSE.DRV
%WINDIR%\system\SOUND.DRV
%WINDIR%\srchasst\mui\0409\lcltechy.xml
%WINDIR%\srchasst\mui\0409\lcllook.xml
%WINDIR%\srchasst\mui\0409\lclprog.xml
%WINDIR%\srchasst\mui\0409\lclmm.xml
%WINDIR%\srchasst\mui\0409\lclkwrds.xml
%WINDIR%\system\SYSTEM.DRV
%WINDIR%\system\MCIWAVE.DRV
%WINDIR%\system\MCIAVI.DRV
%WINDIR%\srchasst\mui\0409\lclmode.xml
<SYSTEM32>\attrib.exe
<SYSTEM32>\alg.exe
<SYSTEM32>\ansi.sys
<SYSTEM32>\asr_ldm.exe
<SYSTEM32>\atmadm.exe
<SYSTEM32>\append.exe
%WINDIR%\system\WFWNET.DRV
<SYSTEM32>\arp.exe
%WINDIR%\system\setup.inf
%WINDIR%\system\VGA.DRV
%WINDIR%\srchasst\mui\0409\lclother.xml
%WINDIR%\system\TIMER.DRV
<SYSTEM32>\accwiz.exe
<SYSTEM32>\ahui.exe
<SYSTEM32>\$winnt$.inf
<SYSTEM32>\actmovie.exe
<SYSTEM32>\cmstp.exe
<SYSTEM32>\DirectX\Dinput\gr4001.ini
<SYSTEM32>\DirectX\Dinput\gr3001.ini
<SYSTEM32>\dfrgfat.exe
<SYSTEM32>\dfrgntfs.exe
<SYSTEM32>\DirectX\Dinput\gr4001_g.ini
<SYSTEM32>\DirectX\Dinput\gr4003.ini
<SYSTEM32>\desktop.ini
<SYSTEM32>\diantz.exe
<SYSTEM32>\ctfmon.exe
<SYSTEM32>\DirectX\Dinput\glmdiggp.ini
<SYSTEM32>\debug.exe
<SYSTEM32>\csrss.exe
<SYSTEM32>\defrag.exe
<SYSTEM32>\DirectX\Dinput\gr3001_g.ini
<SYSTEM32>\DirectX\Dinput\glmda.ini
<SYSTEM32>\DirectX\Dinput\actc094.ini
<SYSTEM32>\DirectX\Dinput\ms27.ini
<SYSTEM32>\DirectX\Dinput\ms34.ini
<SYSTEM32>\DirectX\Dinput\ia3002.ini
<SYSTEM32>\DirectX\Dinput\ms3b.ini
<SYSTEM32>\DirectX\Dinput\ms8.ini
<SYSTEM32>\DirectX\Dinput\ms6.ini
<SYSTEM32>\DirectX\Dinput\ms26.ini
<SYSTEM32>\DirectX\Dinput\ms28.ini
<SYSTEM32>\DirectX\Dinput\gr4005.ini
<SYSTEM32>\DirectX\Dinput\lgc202.ini
<SYSTEM32>\DirectX\Dinput\lgc209.ini
<SYSTEM32>\DirectX\Dinput\lgc207.ini
<SYSTEM32>\DirectX\Dinput\lgc291.ini
<SYSTEM32>\DirectX\Dinput\lgc20a.ini
<SYSTEM32>\DirectX\Dinput\hammer.ini
<SYSTEM32>\DirectX\Dinput\ms1b.ini
<SYSTEM32>\config\systemprofile\Start Menu\Programs\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\<INETFILES>\Content.IE5\RK37EMDC\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\History\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\<INETFILES>\Content.IE5\6YQRA29M\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\<INETFILES>\desktop.ini
<SYSTEM32>\config\systemprofile\Start Menu\desktop.ini
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Entertainment\desktop.ini
<SYSTEM32>\config\systemprofile\SendTo\desktop.ini
<SYSTEM32>\compact.exe
<SYSTEM32>\config\systemprofile\Application Data\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\desktop.ini
<SYSTEM32>\comm.drv
<SYSTEM32>\comp.exe
<SYSTEM32>\config\systemprofile\Local Settings\<INETFILES>\Content.IE5\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\History\History.IE5\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML
<SYSTEM32>\config\systemprofile\Templates\powerpnt.ppt
<SYSTEM32>\control.exe
<SYSTEM32>\conime.exe
<SYSTEM32>\config\systemprofile\Templates\winword2.doc
<SYSTEM32>\ddeshare.exe
<SYSTEM32>\dcomcnfg.exe
<SYSTEM32>\convert.exe
<SYSTEM32>\country.sys
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\desktop.ini
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Startup\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\<INETFILES>\Content.IE5\E4T10P5J\desktop.ini
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\<INETFILES>\Content.IE5\W32JX7IL\desktop.ini
<SYSTEM32>\config\systemprofile\Templates\excel4.xls
<SYSTEM32>\config\systemprofile\Templates\winword.doc
<SYSTEM32>\config\systemprofile\Templates\excel.xls
%WINDIR%\inf\netce3.inf
%WINDIR%\inf\netcem28.inf
%WINDIR%\inf\netce2.inf
%WINDIR%\inf\netcis.inf
%WINDIR%\inf\netcpqc.inf
%WINDIR%\inf\netcpqi.inf
%WINDIR%\inf\netcpqmt.inf
%WINDIR%\inf\netclass.inf
%WINDIR%\inf\netcicap.inf
%WINDIR%\inf\netcb325.inf
%WINDIR%\inf\netbrzw.inf
%WINDIR%\inf\netbrdgs.inf
%WINDIR%\inf\netcem33.inf
%WINDIR%\inf\netcem56.inf
%WINDIR%\inf\netcb102.inf
%WINDIR%\inf\netcbe.inf
%WINDIR%\inf\netejxmp.inf
%WINDIR%\inf\netel5x9.inf
%WINDIR%\inf\nete100i.inf
%WINDIR%\inf\nete1000.inf
%WINDIR%\inf\netel574.inf
%WINDIR%\inf\netel980.inf
%WINDIR%\inf\netel515.inf
%WINDIR%\inf\netel90b.inf
%WINDIR%\inf\netdav.inf
%WINDIR%\inf\netcpqg.inf
%WINDIR%\inf\netdgdxb.inf
%WINDIR%\inf\netctmrk.inf
%WINDIR%\inf\netdm.inf
%WINDIR%\inf\netdlh5x.inf
%WINDIR%\inf\netdf650.inf
%WINDIR%\inf\netdefxa.inf
%WINDIR%\inf\net575nt.inf
%WINDIR%\inf\net559ib.inf
%WINDIR%\inf\net557.inf
%WINDIR%\inf\net650d.inf
%WINDIR%\inf\netali.inf
%WINDIR%\inf\net8511.inf
%WINDIR%\inf\net656n5.inf
%WINDIR%\inf\net656c5.inf
%WINDIR%\inf\net1394.inf
%WINDIR%\inf\net10.inf
%WINDIR%\inf\ndisip.inf
%WINDIR%\inf\net21x4.inf
%WINDIR%\inf\net3c589.inf
%WINDIR%\inf\net5515n.inf
%WINDIR%\inf\net3sr.inf
%WINDIR%\inf\net3c556.inf
%WINDIR%\inf\netan983.inf
%WINDIR%\inf\netbcm4u.inf
%WINDIR%\inf\netasp2k.inf
%WINDIR%\inf\netauni.inf
%WINDIR%\inf\netb57xp.inf
%WINDIR%\inf\netbeac.inf
%WINDIR%\inf\netbcm4e.inf
%WINDIR%\inf\netbrdgm.inf
%WINDIR%\inf\net713.inf
%WINDIR%\inf\netbcm4p.inf
%WINDIR%\inf\net83820.inf
%WINDIR%\inf\netana.inf
%WINDIR%\inf\netamd2.inf
%WINDIR%\inf\netamdhl.inf
%WINDIR%\inf\netambi.inf
%WINDIR%\inf\netamd.inf
%WINDIR%\inf\netel90a.inf
%WINDIR%\inf\netnwlnk.inf
%WINDIR%\inf\netpnic.inf
%WINDIR%\inf\netoc.inf
%WINDIR%\inf\netnovel.inf
%WINDIR%\inf\netosi5.inf
%WINDIR%\inf\netngr.inf
%WINDIR%\inf\netpschd.inf
%WINDIR%\inf\netpc100.inf
%WINDIR%\inf\netmscli.inf
%WINDIR%\inf\netnb.inf
%WINDIR%\inf\netmhzn5.inf
%WINDIR%\inf\netmadge.inf
%WINDIR%\inf\netnf3.inf
%WINDIR%\inf\netosi2c.inf
%WINDIR%\inf\netnwcli.inf
%WINDIR%\inf\netnm.inf
%WINDIR%\inf\netsis.inf
%WINDIR%\inf\netsmc.inf
%WINDIR%\inf\netrtsnt.inf
%WINDIR%\inf\netrtpnt.inf
%WINDIR%\inf\netrwan.inf
%WINDIR%\inf\netsnmp.inf
%WINDIR%\inf\netserv.inf
%WINDIR%\inf\netsk98.inf
%WINDIR%\inf\netrass.inf
%WINDIR%\inf\netpsa.inf
%WINDIR%\inf\netpwr2.inf
%WINDIR%\inf\netrasa.inf
%WINDIR%\inf\netrlw2k.inf
%WINDIR%\inf\netrsvp.inf
%WINDIR%\inf\netrndis.inf
%WINDIR%\inf\netrast.inf
%WINDIR%\inf\netfjvj.inf
%WINDIR%\inf\netfore.inf
%WINDIR%\inf\netfa312.inf
%WINDIR%\inf\netfa410.inf
%WINDIR%\inf\netgpc.inf
%WINDIR%\inf\netfxocm.inf
%WINDIR%\inf\netforeh.inf
%WINDIR%\inf\netfw.inf
%WINDIR%\inf\netepvcp.inf
%WINDIR%\inf\netepicn.inf
%WINDIR%\inf\netepvcm.inf
%WINDIR%\inf\netepro.inf
%WINDIR%\inf\netex10.inf
%WINDIR%\inf\netf56n5.inf
%WINDIR%\inf\netel99x.inf
%WINDIR%\inf\netfjvi.inf
%WINDIR%\inf\netlanep.inf
%WINDIR%\inf\netloop.inf
%WINDIR%\inf\netlm.inf
%WINDIR%\inf\netirsir.inf
%WINDIR%\inf\netlm56.inf
%WINDIR%\inf\netlnev2.inf
%WINDIR%\inf\netlanem.inf
%WINDIR%\inf\netlpd.inf
%WINDIR%\inf\netip6.inf
%WINDIR%\inf\netibm2.inf
%WINDIR%\inf\netias.inf
%WINDIR%\inf\netibm.inf
%WINDIR%\inf\netktc.inf
%WINDIR%\inf\netirda.inf
%WINDIR%\inf\netklsi.inf
%WINDIR%\inf\netiprip.inf
%WINDIR%\inf\mdmtdkj5.inf
%WINDIR%\inf\mdmtdkj6.inf
%WINDIR%\inf\mdmtdk.inf
%WINDIR%\inf\mdmtdkj4.inf
%WINDIR%\inf\mdmtdkj7.inf
%WINDIR%\inf\mdmusrf.inf
%WINDIR%\inf\mdmtexas.inf
%WINDIR%\inf\mdmti.inf
%WINDIR%\inf\mdmsun2.inf
%WINDIR%\inf\mdmsuprv.inf
%WINDIR%\inf\mdmspq28.inf
%WINDIR%\inf\mdmsun1.inf
%WINDIR%\inf\mdmtdkj2.inf
%WINDIR%\inf\mdmtdkj3.inf
%WINDIR%\inf\mdmsupr3.inf
%WINDIR%\inf\mdmsupra.inf
%WINDIR%\inf\mdmzyxel.inf
%WINDIR%\inf\mdmxirmp.inf
%WINDIR%\inf\mdmwhql0.inf
%WINDIR%\inf\mdmx5560.inf
%WINDIR%\inf\mdmzyp.inf
%WINDIR%\inf\medctroc.inf
%WINDIR%\inf\mdmzoom.inf
%WINDIR%\inf\mdmxircc.inf
%WINDIR%\inf\mdmtron.inf
%WINDIR%\inf\mdmusrg.inf
%WINDIR%\inf\mdmusrsp.inf
%WINDIR%\inf\mdmtosh.inf
%WINDIR%\inf\mdmusrgl.inf
%WINDIR%\inf\mdmvv.inf
%WINDIR%\inf\mdmusrk1.inf
%WINDIR%\inf\mdmvdot.inf
%WINDIR%\inf\mdmpenr.inf
%WINDIR%\inf\mdmpp.inf
%WINDIR%\inf\mdmpace.inf
%WINDIR%\inf\mdmpbit.inf
%WINDIR%\inf\mdmpn1.inf
%WINDIR%\inf\mdmracal.inf
%WINDIR%\inf\mdmpctel.inf
%WINDIR%\inf\mdmpin.inf
%WINDIR%\inf\mdmnttp2.inf
%WINDIR%\inf\mdmnttp.inf
%WINDIR%\inf\mdmnttte.inf
%WINDIR%\inf\mdmomrn3.inf
%WINDIR%\inf\mdmolic.inf
%WINDIR%\inf\mdmosice.inf
%WINDIR%\inf\mdmosi.inf
%WINDIR%\inf\mdmoptn.inf
%WINDIR%\inf\mdmsgsmu.inf
%WINDIR%\inf\mdmsier.inf
%WINDIR%\inf\mdmsetup.inf
%WINDIR%\inf\mdmsgsml.inf
%WINDIR%\inf\mdmsmart.inf
%WINDIR%\inf\mdmsonyu.inf
%WINDIR%\inf\mdmsii64.INF
%WINDIR%\inf\mdmsiil6.INF
%WINDIR%\inf\mdmrock3.inf
%WINDIR%\inf\mdmrock.inf
%WINDIR%\inf\mdmpsion.inf
%WINDIR%\inf\mdmrisa.inf
%WINDIR%\inf\mdmrock5.inf
%WINDIR%\inf\mdmrpci.inf
%WINDIR%\inf\mdmrpciw.inf
%WINDIR%\inf\mdmrock4.inf
%WINDIR%\inf\mdmzyxlg.inf
%WINDIR%\inf\msports.inf
%WINDIR%\inf\msnike.inf
%WINDIR%\inf\msnmsn.inf
%WINDIR%\inf\msoe50.inf
%WINDIR%\inf\msxpsdrv.inf
%WINDIR%\inf\mstape.inf
%WINDIR%\inf\msnetmtg.inf
%WINDIR%\inf\msrio.inf
%WINDIR%\inf\msinfo32.inf
%WINDIR%\inf\msmouse.inf
%WINDIR%\inf\mscpqpa1.inf
%WINDIR%\inf\mqsysoc.inf
%WINDIR%\inf\msmscsi.inf
%WINDIR%\inf\msmsgs.inf
%WINDIR%\inf\msmqocm.inf
%WINDIR%\inf\msmusb.inf
%WINDIR%\inf\mxport.inf
%WINDIR%\inf\nabtsfec.inf
%WINDIR%\inf\mwtpdsp.inf
%WINDIR%\inf\mxboard.inf
%WINDIR%\inf\net3c985.inf
%WINDIR%\inf\ndisuio.inf
%WINDIR%\inf\mymusic.inf
%WINDIR%\inf\neo20xx.inf
%WINDIR%\inf\multiprt.inf
%WINDIR%\inf\mtxvideo.inf
%WINDIR%\inf\mstask.inf
%WINDIR%\inf\msrio8.inf
%WINDIR%\inf\mwmbatam.inf
%WINDIR%\inf\mwavmdm1.inf
%WINDIR%\inf\multimed.inf
%WINDIR%\inf\mwremove.inf
%WINDIR%\inf\mfosi5.inf
%WINDIR%\inf\mfsocket.inf
%WINDIR%\inf\mfmhzn5.inf
%WINDIR%\inf\mflm56.inf
%WINDIR%\inf\mfsupra.inf
%WINDIR%\inf\mgau.inf
%WINDIR%\inf\minioc.inf
%WINDIR%\inf\mfx56nf.inf
%WINDIR%\inf\memstpci.inf
%WINDIR%\inf\mfcem33.inf
%WINDIR%\inf\memcard.inf
%WINDIR%\inf\mfcem28.inf
%WINDIR%\inf\mflm.inf
%WINDIR%\inf\mff56n5.inf
%WINDIR%\inf\mf.inf
%WINDIR%\inf\mfcem56.inf
%WINDIR%\inf\moviemk.inf
%WINDIR%\inf\mpe.inf
%WINDIR%\inf\monitor8.inf
%WINDIR%\inf\monitor7.inf
%WINDIR%\inf\msdv.inf
%WINDIR%\inf\mshdc.inf
%WINDIR%\inf\mplayer2.inf
%WINDIR%\inf\mpsstln.inf
%WINDIR%\inf\monitor4.inf
%WINDIR%\inf\monitor2.inf
%WINDIR%\inf\monitor.inf
%WINDIR%\inf\modemcsa.inf
%WINDIR%\inf\monitor6.inf
%WINDIR%\inf\monitor5.inf
%WINDIR%\inf\monitor3.inf
%WINDIR%\inf\mmopt.inf
%WINDIR%\inf\wfp6.inf
%WINDIR%\inf\wfp8.inf
%WINDIR%\inf\wtv1.inf
%WINDIR%\inf\wmaccess.inf
%WINDIR%\inf\wfp5.inf
%WINDIR%\inf\wmtour.inf
%WINDIR%\inf\wmp.inf
%WINDIR%\inf\wordpad.inf
%WINDIR%\inf\wfp2.inf
%WINDIR%\inf\wfp4.inf
%WINDIR%\inf\wfp1.inf
%WINDIR%\inf\wfp0.inf
%WINDIR%\inf\wmfsdk.inf
%WINDIR%\inf\wsh.inf
%WINDIR%\inf\wfp3.inf
%WINDIR%\inf\wfp7.inf
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\XPSViewer_X86.exe
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\PresentationHost_X86.exe
%WINDIR%\inf\xscan_xp.inf
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\corperfmonsymbols.ini
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_perf.ini
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_perf2.ini
%WINDIR%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe
%WINDIR%\Microsoft.NET\Framework\NETFXSBS10.exe
%WINDIR%\inf\wstcodec.inf
%WINDIR%\inf\wmdm.inf
%WINDIR%\inf\wtv0.inf
%WINDIR%\inf\wmpocm.inf
%WINDIR%\inf\wtv3.inf
%WINDIR%\inf\wtv4.inf
%WINDIR%\inf\wtv2.inf
%WINDIR%\inf\wtv5.inf
%WINDIR%\inf\wdma_aur.inf
%WINDIR%\inf\wdma_avc.inf
%WINDIR%\inf\wab50.inf
%WINDIR%\inf\wdma_ali.inf
%WINDIR%\inf\wdma_csf.inf
%WINDIR%\inf\wdma_cwr.inf
%WINDIR%\inf\wdma_csc.inf
%WINDIR%\inf\wdma_azt.inf
%WINDIR%\inf\wdma10k1.inf
%WINDIR%\inf\wceusbsh.inf
%WINDIR%\inf\volume.inf
%WINDIR%\inf\wbemoc.inf
%WINDIR%\inf\wdmaudio.inf
%WINDIR%\inf\wave.inf
%WINDIR%\inf\wbfirdma.inf
%WINDIR%\inf\wbemsnmp.inf
%WINDIR%\inf\wdma_usb.inf
%WINDIR%\inf\wdma_ne2.inf
%WINDIR%\inf\wdma_neo.inf
%WINDIR%\inf\wdma_m2e.inf
%WINDIR%\inf\wdma_via.inf
%WINDIR%\inf\wdmjoy.inf
%WINDIR%\inf\wdma_sis.inf
%WINDIR%\inf\wdma_ym2.inf
%WINDIR%\inf\wdma_rip.inf
%WINDIR%\inf\wdma_ess.inf
%WINDIR%\inf\wdma_ctl.inf
%WINDIR%\inf\wdma_ens.inf
%WINDIR%\inf\wdma_ymh.inf
%WINDIR%\inf\wdma_es3.inf
%WINDIR%\inf\wdma_es2.inf
%WINDIR%\inf\wdma_int.inf
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state_perf.ini
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RedistList\FrameworkList.xml
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\_DataPerfCounters.ini
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\_ServiceModelOperationPerfCounters.ini
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\_ServiceModelServicePerfCounters.ini
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\SubsetList\Client.xml
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\_ServiceModelEndpointPerfCounters.ini
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\_DataOracleClientPerfCounters_shared12_neutral.ini
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\_dataperfcounters_shared12_neutral.ini
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\_Networkingperfcounters.ini
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConsumerCommands.xml
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_perf2.ini
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.ini
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\corperfmonsymbols.ini
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\_Networkingperfcounters.ini
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\_dataperfcounters.ini
%WINDIR%\inf\pcmcia.inf
%WINDIR%\inf\ovsound.inf
%WINDIR%\inf\optional.inf
%WINDIR%\inf\phil1vid.inf
%WINDIR%\inf\ovcomp.inf
%WINDIR%\inf\perm2.inf
%WINDIR%\inf\pchealth.inf
%WINDIR%\inf\p2p.inf
%WINDIR%\inf\oem0.inf
%WINDIR%\inf\oem1.inf
%WINDIR%\inf\oeaccess.inf
%WINDIR%\inf\oem2.inf
%WINDIR%\inf\ovcam.inf
%WINDIR%\inf\parhmse.inf
%WINDIR%\inf\oobe.inf
%WINDIR%\inf\perm3.inf
%WINDIR%\inf\ptpusb.inf
%WINDIR%\inf\s3sav4.inf
%WINDIR%\inf\qmgr.inf
%WINDIR%\inf\prtupg9x.inf
%WINDIR%\inf\ppa3.inf
%WINDIR%\inf\rootau.inf
%WINDIR%\inf\ramdisk.inf
%WINDIR%\inf\printupg.inf
%WINDIR%\inf\phil2vid.inf
%WINDIR%\inf\philtune.inf
%WINDIR%\inf\phdsext.inf
%WINDIR%\inf\phildec.inf
%WINDIR%\inf\pmxmcro.inf
%WINDIR%\inf\ppa.inf
%WINDIR%\inf\pinball.inf
%WINDIR%\inf\pnpscsi.inf
%WINDIR%\inf\nettun.inf
%WINDIR%\inf\nettpro.inf
%WINDIR%\inf\netupnp.inf
%WINDIR%\inf\nettpsmp.inf
%WINDIR%\inf\ntprint.inf
%WINDIR%\inf\netw926.inf
%WINDIR%\inf\netupnph.inf
%WINDIR%\inf\netvt86.inf
%WINDIR%\inf\netsla30.inf
%WINDIR%\inf\netsnip.inf
%WINDIR%\inf\netsap.inf
%WINDIR%\inf\netsk_fp.inf
%WINDIR%\inf\nettcpip.inf
%WINDIR%\inf\nettdkb.inf
%WINDIR%\inf\nettb155.inf
%WINDIR%\inf\nettiger.inf
%WINDIR%\inf\ntgrip.inf
%WINDIR%\inf\netx500.inf
%WINDIR%\inf\netwzc.inf
%WINDIR%\inf\nv3.inf
%WINDIR%\inf\nvts.inf
%WINDIR%\inf\nvdm.inf
%WINDIR%\inf\nvct.inf
%WINDIR%\inf\nv4_disp.inf
%WINDIR%\inf\netw940.inf
%WINDIR%\inf\netwlan.inf
%WINDIR%\inf\netw840.inf
%WINDIR%\inf\netx56n5.inf
%WINDIR%\inf\netwlan2.inf
%WINDIR%\inf\ntapm.inf
%WINDIR%\inf\netwv48.inf
%WINDIR%\inf\netxcpq.inf
%WINDIR%\inf\s3savmx.inf
%WINDIR%\inf\syscomp.inf
%WINDIR%\inf\tabletpc.inf
%WINDIR%\inf\tridxp.inf
%WINDIR%\inf\swnt.inf
%WINDIR%\inf\tdibth.inf
%WINDIR%\inf\tsbvcap.inf
%WINDIR%\inf\tridkb.inf
%WINDIR%\inf\trid3d.inf
%WINDIR%\inf\sysoc.inf
%WINDIR%\inf\swflash.inf
%WINDIR%\inf\stalport.inf
%WINDIR%\inf\stillcam.inf
%WINDIR%\inf\syssetup.inf
%WINDIR%\inf\svcpack.inf
%WINDIR%\inf\sti.inf
%WINDIR%\inf\streamip.inf
%WINDIR%\inf\usbport.inf
%WINDIR%\inf\usb.inf
%WINDIR%\inf\viafir2k.inf
%WINDIR%\inf\volsnap.inf
%WINDIR%\inf\vgx.inf
%WINDIR%\inf\usbvideo.inf
%WINDIR%\inf\usbprint.inf
%WINDIR%\inf\usbstor.inf
%WINDIR%\inf\tape.inf
%WINDIR%\inf\tgiu.inf
%WINDIR%\inf\tsoc.inf
%WINDIR%\inf\tshoot.inf
%WINDIR%\inf\unknown.inf
%WINDIR%\inf\unregmp2.exe
%WINDIR%\inf\umax.inf
%WINDIR%\inf\umaxpp.inf
%WINDIR%\inf\sdbus.inf
%WINDIR%\inf\secdrv.inf
%WINDIR%\inf\sdwndr2k.inf
%WINDIR%\inf\scsidev.inf
%WINDIR%\inf\sis300i.inf
%WINDIR%\inf\sgiu.inf
%WINDIR%\inf\secrecs.inf
%WINDIR%\inf\setupqry.inf
%WINDIR%\inf\ricoh.inf
%WINDIR%\inf\sapi5.inf
%WINDIR%\inf\ps5333.inf
%WINDIR%\inf\s3sav3d.inf
%WINDIR%\inf\sceregvl.inf
%WINDIR%\inf\scsi.inf
%WINDIR%\inf\s3trio3d.inf
%WINDIR%\inf\sbp2.inf
%WINDIR%\inf\slip.inf
%WINDIR%\inf\spxports.inf
%WINDIR%\inf\sonypvu1.inf
%WINDIR%\inf\smi.inf
%WINDIR%\inf\srchasst.inf
%WINDIR%\inf\srusbusd.inf
%WINDIR%\inf\sr.inf
%WINDIR%\inf\spx.inf
%WINDIR%\inf\sffdisk.inf
%WINDIR%\inf\sisv6326.inf
%WINDIR%\inf\sisgr.inf
%WINDIR%\inf\shl_img.inf
%WINDIR%\inf\skins.inf
%WINDIR%\inf\sis6306.inf
%WINDIR%\inf\shell.inf
%WINDIR%\inf\smartcrd.inf
<SYSTEM32>\dllcache\evntwin.exe
<SYSTEM32>\mnmsrvc.exe
<SYSTEM32>\mciwave.drv
<SYSTEM32>\migpwd.exe
<SYSTEM32>\mem.exe
<SYSTEM32>\lsass.exe
<SYSTEM32>\mplay32.exe
<SYSTEM32>\mountvol.exe
<SYSTEM32>\mobsync.exe
<SYSTEM32>\mciavi.drv
<SYSTEM32>\logoff.exe
<SYSTEM32>\lpq.exe
<SYSTEM32>\lpr.exe
<SYSTEM32>\logman.exe
<SYSTEM32>\mciseq.drv
<SYSTEM32>\makecab.exe
<SYSTEM32>\mmdriver.inf
<SYSTEM32>\msacm32.drv
<SYSTEM32>\mshta.exe
<SYSTEM32>\msh261.drv
<SYSTEM32>\mscdexnt.exe
<SYSTEM32>\mspaint.exe
<SYSTEM32>\msg.exe
<SYSTEM32>\msh263.drv
<SYSTEM32>\msdtc.exe
<SYSTEM32>\mqtgsvc.exe
<SYSTEM32>\msdtcprf.ini
<SYSTEM32>\mouse.drv
<SYSTEM32>\mqsvc.exe
<SYSTEM32>\mqbkup.exe
<SYSTEM32>\mqperf.ini
<SYSTEM32>\mrinfo.exe
<SYSTEM32>\mpnotify.exe
<SYSTEM32>\iexpress.exe
<SYSTEM32>\ie4uinit.exe
<SYSTEM32>\imapi.exe
<SYSTEM32>\ipv6.exe
<SYSTEM32>\ipconfig.exe
<SYSTEM32>\icsxml\potscfg.xml
<SYSTEM32>\icsxml\ipcfg.xml
<SYSTEM32>\ieuinit.inf
<SYSTEM32>\icardagt.exe
<SYSTEM32>\hostname.exe
<SYSTEM32>\gpupdate.exe
<SYSTEM32>\ias\ias.mdb
<SYSTEM32>\icsxml\osinfo.xml
<SYSTEM32>\ipsec6.exe
<SYSTEM32>\ias\dnary.mdb
<SYSTEM32>\icsxml\cmnicfg.xml
<SYSTEM32>\lodctr.exe
<SYSTEM32>\lights.exe
<SYSTEM32>\lnkstub.exe
<SYSTEM32>\locator.exe
<SYSTEM32>\logagent.exe
<SYSTEM32>\magnify.exe
<SYSTEM32>\logonui.exe
<SYSTEM32>\mmc.exe
<SYSTEM32>\key01.sys
<SYSTEM32>\keyboard.drv
<SYSTEM32>\icsxml\pppcfg.xml
<SYSTEM32>\ipxroute.exe
<SYSTEM32>\lanman.drv
<SYSTEM32>\keyboard.sys
<SYSTEM32>\label.exe
<SYSTEM32>\krnl386.exe
<SYSTEM32>\mshearts.exe
<SYSTEM32>\oobe\html\mouse\images\parism.jpg
<SYSTEM32>\oobe\html\mouse\images\praguem.jpg
<SYSTEM32>\nwscript.exe
<SYSTEM32>\odbcconf.exe
<SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg
<SYSTEM32>\oobe\html\mouse\images\pisam.jpg
<SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg
<SYSTEM32>\oobe\html\mouse\images\verona.jpg
<SYSTEM32>\ntsd.exe
<SYSTEM32>\oobe\html\mouse\images\heidelb.jpg
<SYSTEM32>\oobe\html\mouse\images\bulzano.jpg
<SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg
<SYSTEM32>\oobe\html\mouse\images\paris.jpg
<SYSTEM32>\odbcad32.exe
<SYSTEM32>\nw16.exe
<SYSTEM32>\oobe\html\mouse\images\pisa.jpg
<SYSTEM32>\oobe\images\newbtm1.jpg
<SYSTEM32>\oobe\images\newmark8.jpg
<SYSTEM32>\oobe\images\backoff.jpg
<SYSTEM32>\oobe\images\mslogo.jpg
<SYSTEM32>\oobe\images\newtop1.jpg
<SYSTEM32>\oobe\images\newtop8.jpg
<SYSTEM32>\oobe\images\newmark1.jpg
<SYSTEM32>\oobe\images\newbtm8.jpg
<SYSTEM32>\oobe\html\mouse\images\venicem.jpg
<SYSTEM32>\oobe\html\mouse\images\tyrol.jpg
<SYSTEM32>\oobe\html\mouse\images\prague.jpg
<SYSTEM32>\oobe\html\mouse\images\venice.jpg
<SYSTEM32>\oobe\images\backover.jpg
<SYSTEM32>\oobe\images\backup.jpg
<SYSTEM32>\oobe\html\mouse\images\veronam.jpg
<SYSTEM32>\oobe\images\backdown.jpg
<SYSTEM32>\netdde.exe
<SYSTEM32>\ntbackup.exe
<SYSTEM32>\net1.exe
<SYSTEM32>\ntoskrnl.exe
<SYSTEM32>\ntdos404.sys
<SYSTEM32>\netware.drv
<SYSTEM32>\ntkrnlpa.exe
<SYSTEM32>\netsh.exe
<SYSTEM32>\msswchx.exe
<SYSTEM32>\msiexec.exe
<SYSTEM32>\mstsc.exe
<SYSTEM32>\mstinit.exe
<SYSTEM32>\nddeapir.exe
<SYSTEM32>\net.exe
<SYSTEM32>\nbtstat.exe
<SYSTEM32>\narrator.exe
<SYSTEM32>\ntio412.sys
<SYSTEM32>\ntio411.sys
<SYSTEM32>\ntio.sys
<SYSTEM32>\ntdos411.sys
<SYSTEM32>\ntio804.sys
<SYSTEM32>\ntvdm.exe
<SYSTEM32>\ntdos804.sys
<SYSTEM32>\ntdos.sys
<SYSTEM32>\netsetup.exe
<SYSTEM32>\nslookup.exe
<SYSTEM32>\notepad.exe
<SYSTEM32>\netstat.exe
<SYSTEM32>\npp\nppagent.exe
<SYSTEM32>\ntio404.sys
<SYSTEM32>\nlsfunc.exe
<SYSTEM32>\ntdos412.sys
<DRIVERS>\raspppoe.sys
<DRIVERS>\rdpdr.sys
<DRIVERS>\rawwan.sys
<DRIVERS>\rdbss.sys
<DRIVERS>\rio8drv.sys
<DRIVERS>\riodrv.sys
<DRIVERS>\rdpwd.sys
<DRIVERS>\redbook.sys
<DRIVERS>\psched.sys
<DRIVERS>\processr.sys
<DRIVERS>\raspti.sys
<DRIVERS>\pciidex.sys
<DRIVERS>\raspptp.sys
<DRIVERS>\rasl2tp.sys
<DRIVERS>\ptilink.sys
<DRIVERS>\rdpcdd.sys
<DRIVERS>\sonydcam.sys
<DRIVERS>\sfloppy.sys
<DRIVERS>\serenum.sys
<DRIVERS>\sffdisk.sys
<DRIVERS>\smclib.sys
<DRIVERS>\swenum.sys
<DRIVERS>\sffp_sd.sys
<DRIVERS>\sr.sys
<DRIVERS>\rootmdm.sys
<DRIVERS>\sdbus.sys
<DRIVERS>\RMCast.sys
<DRIVERS>\rndismp.sys
<DRIVERS>\srv.sys
<DRIVERS>\serial.sys
<DRIVERS>\scsiport.sys
<DRIVERS>\secdrv.sys
<DRIVERS>\nic1394.sys
<DRIVERS>\netbios.sys
<DRIVERS>\ndiswan.sys
<DRIVERS>\ndproxy.sys
<DRIVERS>\npfs.sys
<DRIVERS>\nwrdr.sys
<DRIVERS>\ntfs.sys
<DRIVERS>\netbt.sys
<DRIVERS>\mqac.sys
<DRIVERS>\ndistapi.sys
<DRIVERS>\mssmbios.sys
<DRIVERS>\mouclass.sys
<DRIVERS>\ndis.sys
<DRIVERS>\ndisuio.sys
<DRIVERS>\mup.sys
<DRIVERS>\msgpc.sys
<DRIVERS>\parport.sys
<DRIVERS>\partmgr.sys
<DRIVERS>\nwlnkfwd.sys
<DRIVERS>\oprghdlr.sys
<DRIVERS>\parvdm.sys
<DRIVERS>\pci.sys
<DRIVERS>\pcmcia.sys
<DRIVERS>\rasacd.sys
<DRIVERS>\nikedrv.sys
<DRIVERS>\nwlnkflt.sys
<DRIVERS>\null.sys
<DRIVERS>\nmnt.sys
<DRIVERS>\nwlnkipx.sys
<DRIVERS>\p3.sys
<DRIVERS>\nwlnkspx.sys
<DRIVERS>\nwlnknb.sys
<DRIVERS>\stream.sys
<SYSTEM32>\fc.exe
<SYSTEM32>\findstr.exe
<SYSTEM32>\expand.exe
<SYSTEM32>\fastopen.exe
<SYSTEM32>\eventcreate.exe
<SYSTEM32>\eventtriggers.exe
<SYSTEM32>\extrac32.exe
<SYSTEM32>\find.exe
<SYSTEM32>\dvdupgrd.exe
<SYSTEM32>\edlin.exe
<SYSTEM32>\dwwin.exe
<SYSTEM32>\dvdplay.exe
<SYSTEM32>\eventvwr.exe
<SYSTEM32>\exe2bin.exe
<SYSTEM32>\eudcedit.exe
<SYSTEM32>\esentutl.exe
<SYSTEM32>\himem.sys
<SYSTEM32>\fsutil.exe
<SYSTEM32>\getmac.exe
<SYSTEM32>\gpresult.exe
<SYSTEM32>\help.exe
<SYSTEM32>\homepage.inf
<SYSTEM32>\gdi.exe
<SYSTEM32>\grpconv.exe
<SYSTEM32>\ftp.exe
<SYSTEM32>\freecell.exe
<SYSTEM32>\finger.exe
<SYSTEM32>\fontview.exe
<SYSTEM32>\forcedos.exe
<SYSTEM32>\fixmapi.exe
<SYSTEM32>\fltMc.exe
<SYSTEM32>\fsquirt.exe
<DRIVERS>\tunmp.sys
<DRIVERS>\usb8023.sys
<DRIVERS>\udfs.sys
<DRIVERS>\tsbvcap.sys
<DRIVERS>\update.sys
<DRIVERS>\ws2ifsl.sys
<DRIVERS>\usbcamd.sys
<DRIVERS>\usbcamd2.sys
<DRIVERS>\tcpip6.sys
<DRIVERS>\tdi.sys
<DRIVERS>\tcpip.sys
<DRIVERS>\tape.sys
<DRIVERS>\tosdvd.sys
<DRIVERS>\termdd.sys
<DRIVERS>\tdtcp.sys
<DRIVERS>\tdpipe.sys
<DRIVERS>\xxhgfs.sys
<SYSTEM32>\drwatson.exe
<DRIVERS>\xrwebvirtnet.sys
<SYSTEM32>\dxdiag.exe
<SYSTEM32>\drwtsn32.exe
<SYSTEM32>\dumprep.exe
<SYSTEM32>\esentprf.ini
<DRIVERS>\xxx_svga.sys
<DRIVERS>\vga.sys
<DRIVERS>\volsnap.sys
<DRIVERS>\usbintel.sys
<DRIVERS>\vdmindvd.sys
<DRIVERS>\wanarp.sys
<DRIVERS>\XXSCSI.sys
<DRIVERS>\videoprt.sys
<DRIVERS>\wmilib.sys
<SYSTEM32>\usrmlnka.exe
<SYSTEM32>\wbem\scrcons.exe
<SYSTEM32>\URTTEMP\regtlib.exe
<SYSTEM32>\usmt\usmtdef.inf
<SYSTEM32>\vga.drv
<SYSTEM32>\usrshuta.exe
<SYSTEM32>\vssvc.exe
<SYSTEM32>\verifier.exe
<SYSTEM32>\userinit.exe
<SYSTEM32>\usmt\migwiz.inf
<SYSTEM32>\usmt\migload.exe
<SYSTEM32>\ups.exe
<SYSTEM32>\usmt\migwiz_a.exe
<SYSTEM32>\usmt\migwiz.exe
<SYSTEM32>\usmt\migsys.inf
<SYSTEM32>\usmt\miguser.inf
<SYSTEM32>\wbem\Performance\WmiApRpl.ini
<SYSTEM32>\wbem\wmiadap.exe
<SYSTEM32>\wbem\wmic.exe
<SYSTEM32>\wbem\winmgmt.exe
<SYSTEM32>\wextract.exe
<SYSTEM32>\wdmaud.drv
<SYSTEM32>\w32tm.exe
<SYSTEM32>\wbem\wmiapsrv.exe
<SYSTEM32>\wbem\unsecapp.exe
<SYSTEM32>\vssadmin.exe
<SYSTEM32>\utilman.exe
<SYSTEM32>\usrprbda.exe
<SYSTEM32>\watchdog.sys
<SYSTEM32>\vwipxspx.exe
<SYSTEM32>\wbem\mofcomp.exe
<SYSTEM32>\wbem\wbemtest.exe
<SYSTEM32>\telnet.exe
<SYSTEM32>\tlntsess.exe
<SYSTEM32>\taskman.exe
<SYSTEM32>\tlntadmn.exe
<SYSTEM32>\tlntsvr.exe
<SYSTEM32>\tracert6.exe
<SYSTEM32>\timer.drv
<SYSTEM32>\tracerpt.exe
<SYSTEM32>\tcmsetup.exe
<SYSTEM32>\tcpsvcs.exe
<SYSTEM32>\taskmgr.exe
<SYSTEM32>\systeminfo.exe
<SYSTEM32>\tasklist.exe
<SYSTEM32>\tftp.exe
<SYSTEM32>\taskkill.exe
<SYSTEM32>\tcpmon.ini
<SYSTEM32>\tslabels.ini
<SYSTEM32>\upnpcont.exe
<SYSTEM32>\unlodctr.exe
<SYSTEM32>\tsshutdn.exe
<SYSTEM32>\user.exe
<SYSTEM32>\TsWpfWrp.exe
<SYSTEM32>\typeperf.exe
<SYSTEM32>\usmt\sysfiles.inf
<SYSTEM32>\tscon.exe
<SYSTEM32>\tsdiscon.exe
<SYSTEM32>\tracert.exe
<SYSTEM32>\tscupgrd.exe
<SYSTEM32>\usmt\migapp.inf
<SYSTEM32>\usmt\migism.inf
<SYSTEM32>\tourstart.exe
<SYSTEM32>\tskill.exe
<SYSTEM32>\wbem\wmiprvse.exe
%WINDIR%\Web\Wallpaper\Red moon desert.jpg
%WINDIR%\XXInstall\cmdow.exe
%WINDIR%\Web\Wallpaper\Peace.jpg
%WINDIR%\XXInstall\devcon.exe
%WINDIR%\Web\Wallpaper\Ripple.jpg
%WINDIR%\XXInstall\Scripts\WindowsKiller.ini
%WINDIR%\XXInstall\exdir.exe
%WINDIR%\Web\Wallpaper\Purple flower.jpg
%WINDIR%\Web\Wallpaper\Follow.jpg
%WINDIR%\Web\Wallpaper\Friend.jpg
%WINDIR%\Web\Wallpaper\Azul.jpg
%WINDIR%\Tasks\desktop.ini
%WINDIR%\Web\Wallpaper\Moon flower.jpg
%WINDIR%\Web\Wallpaper\Power.jpg
%WINDIR%\Web\Wallpaper\Crystal.jpg
%WINDIR%\Web\Wallpaper\Home.jpg
%WINDIR%\Web\Wallpaper\Stonehenge.jpg
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
%WINDIR%\Web\Wallpaper\Tulips.jpg
%WINDIR%\Web\Wallpaper\Vortec space.jpg
%WINDIR%\Web\Wallpaper\Wind.jpg
%WINDIR%\Web\Wallpaper\Windows XP.jpg
%WINDIR%\winhlp32.exe
%WINDIR%\win.ini
%WINDIR%\XXInstall\Scripts\antivm.exe
%WINDIR%\XXInstall\hashdeep.exe
%WINDIR%\XXInstall\events.exe
%WINDIR%\Web\Wallpaper\Radiance.jpg
%WINDIR%\winhelp.exe
%WINDIR%\XXInstall\vminstall.exe
%WINDIR%\XXInstall\screen.exe
%WINDIR%\XXInstall\ps.exe
<SYSTEM32>\winspool.exe
<SYSTEM32>\winmine.exe
<SYSTEM32>\wowexec.exe
<SYSTEM32>\wpabaln.exe
<SYSTEM32>\wscntfy.exe
<SYSTEM32>\wpnpinst.exe
<SYSTEM32>\wowdeb.exe
<SYSTEM32>\winlogon.exe
<SYSTEM32>\wiaacmgr.exe
<SYSTEM32>\winhlp32.exe
<SYSTEM32>\wbem\xsl-mappings.xml
<SYSTEM32>\wfwnet.drv
<SYSTEM32>\winchat.exe
<SYSTEM32>\winver.exe
<SYSTEM32>\winmsd.exe
<SYSTEM32>\win32k.sys
%WINDIR%\twunk_16.exe
%WINDIR%\Web\Wallpaper\Ascent.jpg
<SYSTEM32>\XPSViewer\XPSViewerManifest.xml
%WINDIR%\TASKMAN.EXE
%WINDIR%\twunk_32.exe
%WINDIR%\vb.ini
%WINDIR%\vbaddin.ini
%WINDIR%\Web\Wallpaper\Autumn.jpg
<SYSTEM32>\wuauclt1.exe
<SYSTEM32>\wupdmgr.exe
<SYSTEM32>\winspool.drv
<SYSTEM32>\write.exe
<SYSTEM32>\XPSViewer\XPSViewer.exe
<SYSTEM32>\xcopy.exe
<SYSTEM32>\wscript.exe
<SYSTEM32>\wuauclt.exe
<SYSTEM32>\ras\switch.inf
<SYSTEM32>\rasautou.exe
<SYSTEM32>\PresentationHost.exe
<SYSTEM32>\ras\pad.inf
<SYSTEM32>\rasdial.exe
<SYSTEM32>\rcp.exe
<SYSTEM32>\qwinsta.exe
<SYSTEM32>\rasctrs.ini
<SYSTEM32>\PerfStringBackup.INI
<SYSTEM32>\qappsrv.exe
<SYSTEM32>\ping6.exe
<SYSTEM32>\prodspec.ini
<SYSTEM32>\qprocess.exe
<SYSTEM32>\pschdprf.ini
<SYSTEM32>\proquota.exe
<SYSTEM32>\proxycfg.exe
<SYSTEM32>\regwiz.exe
<SYSTEM32>\regedt32.exe
<SYSTEM32>\reg.exe
<SYSTEM32>\regini.exe
<SYSTEM32>\reset.exe
<SYSTEM32>\relog.exe
<SYSTEM32>\replace.exe
<SYSTEM32>\Restore\rstrui.exe
<SYSTEM32>\rdpclip.exe
<SYSTEM32>\rdshost.exe
<SYSTEM32>\rcimlby.exe
<SYSTEM32>\rasphone.exe
<SYSTEM32>\recover.exe
<SYSTEM32>\regsvr32.exe
<SYSTEM32>\rdsaddin.exe
<SYSTEM32>\redir.exe
<SYSTEM32>\oobe\images\skipup.jpg
<SYSTEM32>\oobe\images\skipover.jpg
<SYSTEM32>\oobe\images\wpaflag.jpg
<SYSTEM32>\oobe\images\wpaback.jpg
<SYSTEM32>\oobe\msoobe.exe
<SYSTEM32>\oobe\images\wpatop.jpg
<SYSTEM32>\oobe\oobeinfo.ini
<SYSTEM32>\oobe\images\wpabtm.jpg
<SYSTEM32>\oobe\images\nextdown.jpg
<SYSTEM32>\oobe\images\nextover.jpg
<SYSTEM32>\oobe\images\oemcoa.jpg
<SYSTEM32>\oobe\images\nextoff.jpg
<SYSTEM32>\oobe\images\wpakey.jpg
<SYSTEM32>\oobe\images\skipdown.jpg
<SYSTEM32>\oobe\images\nextup.jpg
<SYSTEM32>\oobe\images\skipoff.jpg
<SYSTEM32>\perfmon.exe
<SYSTEM32>\perfwci.ini
<SYSTEM32>\pentnt.exe
<SYSTEM32>\perffilt.ini
<SYSTEM32>\progman.exe
<SYSTEM32>\ping.exe
<SYSTEM32>\print.exe
<SYSTEM32>\powercfg.exe
<SYSTEM32>\oobe\phone.inf
<SYSTEM32>\pathping.exe
<SYSTEM32>\oobe\oobebaln.exe
<SYSTEM32>\osk.exe
<SYSTEM32>\perfci.ini
<SYSTEM32>\openfiles.exe
<SYSTEM32>\osuninst.exe
<SYSTEM32>\packager.exe
<SYSTEM32>\Restore\filelist.xml
<SYSTEM32>\smss.exe
<SYSTEM32>\sort.exe
<SYSTEM32>\sndvol32.exe
<SYSTEM32>\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
<SYSTEM32>\spiisupd.exe
<SYSTEM32>\spnpinst.exe
<SYSTEM32>\spider.exe
<SYSTEM32>\sound.drv
<SYSTEM32>\share.exe
<SYSTEM32>\smbinst.exe
<SYSTEM32>\shutdown.exe
<SYSTEM32>\shmgrate.exe
<SYSTEM32>\sndrec32.exe
<SYSTEM32>\sol.exe
<SYSTEM32>\skeys.exe
<SYSTEM32>\smlogsvc.exe
<SYSTEM32>\svchost.exe
<SYSTEM32>\syskey.exe
<SYSTEM32>\stimon.exe
<SYSTEM32>\sysedit.exe
<SYSTEM32>\sysocmgr.exe
<SYSTEM32>\systray.exe
<SYSTEM32>\system.drv
<SYSTEM32>\spoolsv.exe
<SYSTEM32>\spool\XPSEP\amd64\msxpsdrv.inf
<SYSTEM32>\spool\XPSEP\msxpsdrv.inf
<SYSTEM32>\spool\drivers\w32x86\3\mxdwdui.ini
<SYSTEM32>\spool\XPSEP\i386\msxpsdrv.inf
<SYSTEM32>\subst.exe
<SYSTEM32>\spupdsvc.exe
<SYSTEM32>\syncapp.exe
<SYSTEM32>\sprestrt.exe
<SYSTEM32>\runas.exe
<SYSTEM32>\rtcshare.exe
<SYSTEM32>\rsopprov.exe
<SYSTEM32>\rsnotify.exe
<SYSTEM32>\rundll32.exe
<SYSTEM32>\runonce.exe
<SYSTEM32>\rsvp.exe
<SYSTEM32>\rsvp.ini
<SYSTEM32>\rexec.exe
<SYSTEM32>\routemon.exe
<SYSTEM32>\Restore\srdiag.exe
<SYSTEM32>\route.exe
<SYSTEM32>\rsm.exe
<SYSTEM32>\rsmui.exe
<SYSTEM32>\rsh.exe
<SYSTEM32>\rsmsink.exe
<SYSTEM32>\shadow.exe
<SYSTEM32>\setver.exe
<SYSTEM32>\sessmgr.exe
<SYSTEM32>\sethc.exe
<SYSTEM32>\shrpubw.exe
<SYSTEM32>\sigverif.exe
<SYSTEM32>\services.exe
<SYSTEM32>\sfc.exe
<SYSTEM32>\savedump.exe
<SYSTEM32>\schtasks.exe
<SYSTEM32>\rwinsta.exe
<SYSTEM32>\scardsvr.exe
<SYSTEM32>\secedit.exe
<SYSTEM32>\setup.exe
<SYSTEM32>\sc.exe
<SYSTEM32>\sdbinst.exe
<SYSTEM32>\dllcache\netstat.exe
<SYSTEM32>\dllcache\nmnt.sys
<SYSTEM32>\dllcache\nlsfunc.exe
<SYSTEM32>\dllcache\notepad.exe
<SYSTEM32>\dllcache\ntbackup.exe
<SYSTEM32>\dllcache\nppagent.exe
<SYSTEM32>\dllcache\notiflag.exe
<SYSTEM32>\dllcache\npfs.sys
<SYSTEM32>\dllcache\net.exe
<SYSTEM32>\dllcache\netdde.exe
<SYSTEM32>\dllcache\ndiswan.sys
<SYSTEM32>\dllcache\netbios.sys
<SYSTEM32>\dllcache\netsetup.exe
<SYSTEM32>\dllcache\netsh.exe
<SYSTEM32>\dllcache\ndproxy.sys
<SYSTEM32>\dllcache\netbt.sys
<SYSTEM32>\dllcache\ntio.sys
<SYSTEM32>\dllcache\ntvdm.exe
<SYSTEM32>\dllcache\ntdos412.sys
<SYSTEM32>\dllcache\ntio804.sys
<SYSTEM32>\dllcache\ntsd.exe
<SYSTEM32>\dllcache\nw16.exe
<SYSTEM32>\dllcache\ntio412.sys
<SYSTEM32>\dllcache\null.sys
<SYSTEM32>\dllcache\ntfs.sys
<SYSTEM32>\dllcache\ntdos.sys
<SYSTEM32>\dllcache\ntdos404.sys
<SYSTEM32>\dllcache\nslookup.exe
<SYSTEM32>\dllcache\ntdos411.sys
<SYSTEM32>\dllcache\ntdos804.sys
<SYSTEM32>\dllcache\ntio411.sys
<SYSTEM32>\dllcache\ntio404.sys
<SYSTEM32>\dllcache\mshta.exe
<SYSTEM32>\dllcache\msg.exe
<SYSTEM32>\dllcache\mscdexnt.exe
<SYSTEM32>\dllcache\msfs.sys
<SYSTEM32>\dllcache\msiexec.exe
<SYSTEM32>\dllcache\msimn.exe
<SYSTEM32>\dllcache\mshearts.exe
<SYSTEM32>\dllcache\msgpc.sys
<SYSTEM32>\dllcache\mpnotify.exe
<SYSTEM32>\dllcache\msconfig.exe
<SYSTEM32>\dllcache\mqac.sys
<SYSTEM32>\dllcache\mqsvc.exe
<SYSTEM32>\dllcache\mrinfo.exe
<SYSTEM32>\dllcache\msdtc.exe
<SYSTEM32>\dllcache\mrxdav.sys
<SYSTEM32>\dllcache\mqtgsvc.exe
<SYSTEM32>\dllcache\narrator.exe
<SYSTEM32>\dllcache\ndistapi.sys
<SYSTEM32>\dllcache\mup.sys
<SYSTEM32>\dllcache\mtstocom.exe
<SYSTEM32>\dllcache\net1.exe
<SYSTEM32>\dllcache\nddeapir.exe
<SYSTEM32>\dllcache\ndis.sys
<SYSTEM32>\dllcache\nbtstat.exe
<SYSTEM32>\dllcache\msinfo32.exe
<SYSTEM32>\dllcache\msoobe.exe
<SYSTEM32>\dllcache\msiregmv.exe
<SYSTEM32>\dllcache\mspaint.exe
<SYSTEM32>\dllcache\mstsc.exe
<SYSTEM32>\dllcache\muisetup.exe
<SYSTEM32>\dllcache\mstinit.exe
<SYSTEM32>\dllcache\msswchx.exe
<SYSTEM32>\dllcache\nwlnkfwd.sys
<SYSTEM32>\dllcache\raspti.sys
<SYSTEM32>\dllcache\raspppoe.sys
<SYSTEM32>\dllcache\rasphone.exe
<SYSTEM32>\dllcache\ramdisk.sys
<SYSTEM32>\dllcache\rdshost.exe
<SYSTEM32>\dllcache\rcp.exe
<SYSTEM32>\dllcache\rawwan.sys
<SYSTEM32>\dllcache\raspptp.sys
<SYSTEM32>\dllcache\printfilterpipelinesvc.exe
<SYSTEM32>\dllcache\qwinsta.exe
<SYSTEM32>\dllcache\query.exe
<SYSTEM32>\dllcache\quser.exe
<SYSTEM32>\dllcache\rasacd.sys
<SYSTEM32>\dllcache\rasl2tp.sys
<SYSTEM32>\dllcache\rasautou.exe
<SYSTEM32>\dllcache\rasdial.exe
<SYSTEM32>\dllcache\recover.exe
<SYSTEM32>\dllcache\rdpwd.sys
<SYSTEM32>\dllcache\regedit.exe
<SYSTEM32>\dllcache\rdpclip.exe
<SYSTEM32>\dllcache\replace.exe
<SYSTEM32>\dllcache\rexec.exe
<SYSTEM32>\dllcache\register.exe
<SYSTEM32>\dllcache\regsvr32.exe
<SYSTEM32>\dllcache\rcimlby.exe
<SYSTEM32>\dllcache\rdpcdd.sys
<SYSTEM32>\dllcache\rdsaddin.exe
<SYSTEM32>\dllcache\regedt32.exe
<SYSTEM32>\dllcache\rdbss.sys
<SYSTEM32>\dllcache\redir.exe
<SYSTEM32>\dllcache\regini.exe
<SYSTEM32>\dllcache\reg.exe
<SYSTEM32>\dllcache\parvdm.sys
<SYSTEM32>\dllcache\opnfiles.exe
<SYSTEM32>\dllcache\odbcconf.exe
<SYSTEM32>\dllcache\odbcad32.exe
<SYSTEM32>\dllcache\perfmon.exe
<SYSTEM32>\dllcache\osuninst.exe
<SYSTEM32>\dllcache\oobebaln.exe
<SYSTEM32>\dllcache\osk.exe
<SYSTEM32>\dllcache\nwlnknb.sys
<SYSTEM32>\dllcache\nwrdr.sys
<SYSTEM32>\dllcache\nwlnkflt.sys
<SYSTEM32>\dllcache\nwlnkipx.sys
<SYSTEM32>\dllcache\packager.exe
<SYSTEM32>\dllcache\oemig50.exe
<SYSTEM32>\dllcache\nwlnkspx.sys
<SYSTEM32>\dllcache\nwscript.exe
<SYSTEM32>\dllcache\ptilink.sys
<SYSTEM32>\dllcache\psched.sys
<SYSTEM32>\dllcache\powercfg.exe
<SYSTEM32>\dllcache\proquota.exe
<SYSTEM32>\dllcache\qprocess.exe
<SYSTEM32>\dllcache\qappsrv.exe
<SYSTEM32>\dllcache\proxycfg.exe
<SYSTEM32>\dllcache\progman.exe
<SYSTEM32>\dllcache\pathping.exe
<SYSTEM32>\dllcache\partmgr.sys
<SYSTEM32>\dllcache\ping.exe
<SYSTEM32>\dllcache\pinball.exe
<SYSTEM32>\dllcache\pintlphr.exe
<SYSTEM32>\dllcache\print.exe
<SYSTEM32>\dllcache\pentnt.exe
<SYSTEM32>\dllcache\ping6.exe
<SYSTEM32>\dllcache\icwconn1.exe
<SYSTEM32>\dllcache\himem.sys
<SYSTEM32>\dllcache\helphost.exe
<SYSTEM32>\dllcache\helpsvc.exe
<SYSTEM32>\dllcache\hscupd.exe
<SYSTEM32>\dllcache\hostname.exe
<SYSTEM32>\dllcache\hrtzzm.exe
<SYSTEM32>\dllcache\icwconn2.exe
<SYSTEM32>\dllcache\gpupdate.exe
<SYSTEM32>\dllcache\helpctr.exe
<SYSTEM32>\dllcache\gdi.exe
<SYSTEM32>\dllcache\getmac.exe
<SYSTEM32>\dllcache\grpconv.exe
<SYSTEM32>\dllcache\hh.exe
<SYSTEM32>\dllcache\gprslt.exe
<SYSTEM32>\dllcache\help.exe
<SYSTEM32>\dllcache\imekrmig.exe
<SYSTEM32>\dllcache\iissync.exe
<SYSTEM32>\dllcache\imepadsv.exe
<SYSTEM32>\dllcache\imapi.exe
<SYSTEM32>\dllcache\imjputy.exe
<SYSTEM32>\dllcache\imjpuex.exe
<SYSTEM32>\dllcache\imjpdct.exe
<SYSTEM32>\dllcache\imjpdadm.exe
<SYSTEM32>\dllcache\ie4uinit.exe
<SYSTEM32>\dllcache\iedw.exe
<SYSTEM32>\dllcache\icwrmind.exe
<SYSTEM32>\dllcache\icwtutor.exe
<SYSTEM32>\dllcache\iisrstas.exe
<SYSTEM32>\dllcache\iisreset.exe
<SYSTEM32>\dllcache\iexpress.exe
<SYSTEM32>\dllcache\iexplore.exe
<SYSTEM32>\dllcache\find.exe
<SYSTEM32>\dllcache\fips.sys
<SYSTEM32>\dllcache\fixmapi.exe
<SYSTEM32>\dllcache\findstr.exe
<SYSTEM32>\dllcache\fontview.exe
<SYSTEM32>\dllcache\forcedos.exe
<SYSTEM32>\dllcache\flattemp.exe
<SYSTEM32>\dllcache\fltmc.exe
<SYSTEM32>\dllcache\exe2bin.exe
<SYSTEM32>\dllcache\fastfat.sys
<SYSTEM32>\dllcache\expand.exe
<SYSTEM32>\dllcache\fastopen.exe
<SYSTEM32>\dllcache\EXCH_regtrace.exe
<SYSTEM32>\dllcache\finger.exe
<SYSTEM32>\dllcache\extrac32.exe
<SYSTEM32>\dllcache\fc.exe
<SYSTEM32>\dllcache\fxscover.exe
<SYSTEM32>\dllcache\fxsclnt.exe
<SYSTEM32>\dllcache\fsutil.exe
<SYSTEM32>\dllcache\freecell.exe
<SYSTEM32>\dllcache\ftp.exe
<SYSTEM32>\dllcache\fxssvc.exe
<SYSTEM32>\dllcache\fs_rec.sys
<SYSTEM32>\dllcache\fxssend.exe
<SYSTEM32>\dllcache\fp98sadm.exe
<SYSTEM32>\dllcache\fpadmcgi.exe
<SYSTEM32>\dllcache\fltmgr.sys
<SYSTEM32>\dllcache\fp98swin.exe
<SYSTEM32>\dllcache\framdit.ttf
<SYSTEM32>\dllcache\fpcount.exe
<SYSTEM32>\dllcache\framd.ttf
<SYSTEM32>\dllcache\fpremadm.exe
<SYSTEM32>\dllcache\imjpinst.exe
<SYSTEM32>\dllcache\mciavi.drv
<SYSTEM32>\dllcache\mga.sys
<SYSTEM32>\dllcache\mciseq.drv
<SYSTEM32>\dllcache\mem.exe
<SYSTEM32>\dllcache\migrate.exe
<SYSTEM32>\dllcache\mmc.exe
<SYSTEM32>\dllcache\micross.ttf
<SYSTEM32>\dllcache\migwiz.exe
<SYSTEM32>\dllcache\lsass.exe
<SYSTEM32>\dllcache\lpr.exe
<SYSTEM32>\dllcache\locator.exe
<SYSTEM32>\dllcache\lpq.exe
<SYSTEM32>\dllcache\makecab.exe
<SYSTEM32>\dllcache\mcd.sys
<SYSTEM32>\dllcache\magnify.exe
<SYSTEM32>\dllcache\marlett.ttf
<SYSTEM32>\dllcache\mountmgr.sys
<SYSTEM32>\dllcache\mouse.drv
<SYSTEM32>\dllcache\mnmsrvc.exe
<SYSTEM32>\dllcache\mofcomp.exe
<SYSTEM32>\dllcache\mplay32.exe
<SYSTEM32>\dllcache\mplayer2.exe
<SYSTEM32>\dllcache\mountvol.exe
<SYSTEM32>\dllcache\mqbkup.exe
<SYSTEM32>\dllcache\migisol.exe
<SYSTEM32>\dllcache\migwiz_a.exe
<SYSTEM32>\dllcache\mciwave.drv
<SYSTEM32>\dllcache\moviemk.exe
<SYSTEM32>\dllcache\mnmdd.sys
<SYSTEM32>\dllcache\mobsync.exe
<SYSTEM32>\dllcache\migregdb.exe
<SYSTEM32>\dllcache\migload.exe
<SYSTEM32>\dllcache\ipconfig.exe
<SYSTEM32>\dllcache\ipinip.sys
<SYSTEM32>\dllcache\ip6fw.sys
<SYSTEM32>\dllcache\ipfltdrv.sys
<SYSTEM32>\dllcache\ipsec6.exe
<SYSTEM32>\dllcache\ksecdd.sys
<SYSTEM32>\dllcache\ipsec.sys
<SYSTEM32>\dllcache\ipnat.sys
<SYSTEM32>\dllcache\imjpdsvr.exe
<SYSTEM32>\dllcache\imkrinst.exe
<SYSTEM32>\dllcache\imjprw.exe
<SYSTEM32>\dllcache\imjpmig.exe
<SYSTEM32>\dllcache\inetwiz.exe
<SYSTEM32>\dllcache\imscinst.exe
<SYSTEM32>\dllcache\inetin51.exe
<SYSTEM32>\dllcache\inetmgr.exe
<SYSTEM32>\dllcache\lights.exe
<SYSTEM32>\dllcache\logman.exe
<SYSTEM32>\dllcache\label.exe
<SYSTEM32>\dllcache\logoff.exe
<SYSTEM32>\dllcache\logagent.exe
<SYSTEM32>\dllcache\logonui.exe
<SYSTEM32>\dllcache\lnkstub.exe
<SYSTEM32>\dllcache\lodctr.exe
<SYSTEM32>\dllcache\key01.sys
<SYSTEM32>\dllcache\isignup.exe
<SYSTEM32>\dllcache\ipxroute.exe
<SYSTEM32>\dllcache\ipv6.exe
<SYSTEM32>\dllcache\keyboard.drv
<SYSTEM32>\dllcache\keyboard.sys
<SYSTEM32>\dllcache\krnl386.exe
<SYSTEM32>\dllcache\irenum.sys
<SYSTEM32>\dllcache\wmplayer.exe
<SYSTEM32>\dllcache\ws2ifsl.sys
<SYSTEM32>\dllcache\wpnpinst.exe
<SYSTEM32>\dllcache\wpabaln.exe
<SYSTEM32>\dllcache\wscript.exe
<SYSTEM32>\dllcache\wuauclt1.exe
<SYSTEM32>\dllcache\wupdmgr.exe
<SYSTEM32>\dllcache\wscntfy.exe
<SYSTEM32>\dllcache\wuauclt.exe
<SYSTEM32>\dllcache\wowdeb.exe
<SYSTEM32>\dllcache\wmic.exe
<SYSTEM32>\dllcache\winver.exe
<SYSTEM32>\dllcache\wmiprvse.exe
<SYSTEM32>\dllcache\wowexec.exe
<SYSTEM32>\dllcache\wordpad.exe
<SYSTEM32>\dllcache\write.exe
<DRIVERS>\amdk6.sys
<DRIVERS>\amdk7.sys
<SYSTEM32>\doskey.exe
<DRIVERS>\afd.sys
<SYSTEM32>\dosx.exe
<DRIVERS>\arp1394.sys
<DRIVERS>\AGP440.SYS
<DRIVERS>\atapi.sys
<SYSTEM32>\dllhst3g.exe
<SYSTEM32>\dllhost.exe
<SYSTEM32>\dllcache\zclientm.exe
<SYSTEM32>\dllcache\xcopy.exe
<SYSTEM32>\dmadmin.exe
<DRIVERS>\acpiec.sys
<SYSTEM32>\dmremote.exe
<DRIVERS>\acpi.sys
<SYSTEM32>\dllcache\wfwnet.drv
<SYSTEM32>\dllcache\wbemtest.exe
<SYSTEM32>\dllcache\w32tm.exe
<SYSTEM32>\dllcache\wanarp.sys
<SYSTEM32>\dllcache\wiaacmgr.exe
<SYSTEM32>\dllcache\wabmig.exe
<SYSTEM32>\dllcache\watchdog.sys
<SYSTEM32>\dllcache\wextract.exe
<SYSTEM32>\dllcache\videoprt.sys
<SYSTEM32>\dllcache\vwipxspx.exe
<SYSTEM32>\dllcache\volsnap.sys
<SYSTEM32>\dllcache\verifier.exe
<SYSTEM32>\dllcache\vssadmin.exe
<SYSTEM32>\dllcache\wab.exe
<SYSTEM32>\dllcache\vga.sys
<SYSTEM32>\dllcache\vssvc.exe
<SYSTEM32>\dllcache\winspool.exe
<SYSTEM32>\dllcache\winhstb.exe
<SYSTEM32>\dllcache\winmgmt.exe
<SYSTEM32>\dllcache\winhelp.exe
<SYSTEM32>\dllcache\wmiadap.exe
<SYSTEM32>\dllcache\wmilib.sys
<SYSTEM32>\dllcache\winspool.drv
<SYSTEM32>\dllcache\wmiapsrv.exe
<SYSTEM32>\dllcache\wb32.exe
<SYSTEM32>\dllcache\winhlp32.exe
<SYSTEM32>\dllcache\win32k.sys
<SYSTEM32>\dllcache\winlogon.exe
<SYSTEM32>\dllcache\winmsd.exe
<SYSTEM32>\dllcache\winmine.exe
<SYSTEM32>\dllcache\weitekp9.sys
<SYSTEM32>\dllcache\winchat.exe
<DRIVERS>\asyncmac.sys
<DRIVERS>\http.sys
<DRIVERS>\ftdisk.sys
<DRIVERS>\i8042prt.sys
<DRIVERS>\flpydisk.sys
<DRIVERS>\fs_rec.sys
<DRIVERS>\ipnat.sys
<DRIVERS>\ip6fw.sys
<DRIVERS>\intelppm.sys
<DRIVERS>\fips.sys
<DRIVERS>\imapi.sys
<DRIVERS>\fdc.sys
<DRIVERS>\fastfat.sys
<DRIVERS>\fltMgr.sys
<DRIVERS>\intelide.sys
<DRIVERS>\fsvga.sys
<DRIVERS>\filedisk.sys
<DRIVERS>\mcd.sys
<DRIVERS>\mountmgr.sys
<DRIVERS>\mnmdd.sys
<DRIVERS>\modem.sys
<DRIVERS>\mf.sys
<DRIVERS>\msfs.sys
<DRIVERS>\mrxsmb.sys
<DRIVERS>\mrxdav.sys
<DRIVERS>\ipsec.sys
<DRIVERS>\ks.sys
<DRIVERS>\ipinip.sys
<DRIVERS>\ipfltdrv.sys
<DRIVERS>\isapnp.sys
<DRIVERS>\ksecdd.sys
<DRIVERS>\kbdclass.sys
<DRIVERS>\irenum.sys
<DRIVERS>\bridge.sys
<DRIVERS>\beep.sys
<DRIVERS>\atmlane.sys
<DRIVERS>\battc.sys
<DRIVERS>\cbidf2k.sys
<DRIVERS>\cinemst2.sys
<DRIVERS>\CmBatt.sys
<DRIVERS>\cdaudio.sys
<SYSTEM32>\driverquery.exe
<SYSTEM32>\dpvsetup.exe
<DRIVERS>\atmepvc.sys
<SYSTEM32>\dplaysvr.exe
<DRIVERS>\atmarpc.sys
<DRIVERS>\audstub.sys
<SYSTEM32>\dpnsvr.exe
<DRIVERS>\atmuni.sys
<DRIVERS>\dmio.sys
<DRIVERS>\dmload.sys
<DRIVERS>\disk.sys
<DRIVERS>\DbgPrnHk.sys
<DRIVERS>\dxg.sys
<DRIVERS>\eventmon.sys
<DRIVERS>\dxgthk.sys
<DRIVERS>\dxapi.sys
<DRIVERS>\cdfs.sys
<DRIVERS>\compbatt.sys
<DRIVERS>\crusoe.sys
<DRIVERS>\cdrom.sys
<DRIVERS>\diskdump.sys
<DRIVERS>\cpqdap01.sys
<DRIVERS>\dmboot.sys
<DRIVERS>\classpnp.sys
<SYSTEM32>\dllcache\skeys.exe
<SYSTEM32>\dllcache\shvlzm.exe
<SYSTEM32>\dllcache\shutdown.exe
<SYSTEM32>\dllcache\smclib.sys
<SYSTEM32>\dllcache\shmgrate.exe
<SYSTEM32>\dllcache\smi2smir.exe
<SYSTEM32>\dllcache\smbinst.exe
<SYSTEM32>\dllcache\smss.exe
<SYSTEM32>\dllcache\setup50.exe
<SYSTEM32>\dllcache\sethc.exe
<SYSTEM32>\dllcache\secedit.exe
<SYSTEM32>\dllcache\sessmgr.exe
<SYSTEM32>\dllcache\share.exe
<SYSTEM32>\dllcache\shrpubw.exe
<SYSTEM32>\dllcache\setup.exe
<SYSTEM32>\dllcache\shadow.exe
<SYSTEM32>\dllcache\spider.exe
<SYSTEM32>\dllcache\spiisupd.exe
<SYSTEM32>\dllcache\sort.exe
<SYSTEM32>\dllcache\sound.drv
<SYSTEM32>\dllcache\spoolsv.exe
<SYSTEM32>\dllcache\srv.sys
<SYSTEM32>\dllcache\spnpinst.exe
<SYSTEM32>\dllcache\srdiag.exe
<SYSTEM32>\dllcache\smlogsvc.exe
<SYSTEM32>\dllcache\sndrec32.exe
<SYSTEM32>\dllcache\shtml.exe
<SYSTEM32>\dllcache\sigverif.exe
<SYSTEM32>\dllcache\snmp.exe
<SYSTEM32>\dllcache\sol.exe
<SYSTEM32>\dllcache\sndvol32.exe
<SYSTEM32>\dllcache\snmptrap.exe
<SYSTEM32>\dllcache\route.exe
<SYSTEM32>\dllcache\rsnotify.exe
<SYSTEM32>\dllcache\rmcast.sys
<SYSTEM32>\dllcache\rsmsink.exe
<SYSTEM32>\dllcache\runas.exe
<SYSTEM32>\dllcache\rtcshare.exe
<SYSTEM32>\dllcache\rsh.exe
<SYSTEM32>\dllcache\rsopprov.exe
<SYSTEM32>\dllcache\reset.exe
<SYSTEM32>\dllcache\rootmdm.sys
<SYSTEM32>\dllcache\regwiz.exe
<SYSTEM32>\dllcache\relog.exe
<SYSTEM32>\dllcache\routemon.exe
<SYSTEM32>\dllcache\rstrui.exe
<SYSTEM32>\dllcache\rndismp.sys
<SYSTEM32>\dllcache\rsm.exe
<SYSTEM32>\dllcache\sdbinst.exe
<SYSTEM32>\dllcache\scrcons.exe
<SYSTEM32>\dllcache\savedump.exe
<SYSTEM32>\dllcache\sapisvr.exe
<SYSTEM32>\dllcache\services.exe
<SYSTEM32>\dllcache\sfc.exe
<SYSTEM32>\dllcache\sc.exe
<SYSTEM32>\dllcache\setup_wm.exe
<SYSTEM32>\dllcache\runonce.exe
<SYSTEM32>\dllcache\scardsvr.exe
<SYSTEM32>\dllcache\rsvp.exe
<SYSTEM32>\dllcache\rsmui.exe
<SYSTEM32>\dllcache\sctasks.exe
<SYSTEM32>\dllcache\rwinsta.exe
<SYSTEM32>\dllcache\rundll32.exe
<SYSTEM32>\dllcache\rvsezm.exe
<SYSTEM32>\dllcache\sprestrt.exe
<SYSTEM32>\dllcache\tscupgrd.exe
<SYSTEM32>\dllcache\tsprof.exe
<SYSTEM32>\dllcache\tracert.exe
<SYSTEM32>\dllcache\tscon.exe
<SYSTEM32>\dllcache\tsdiscon.exe
<SYSTEM32>\dllcache\tsshutdn.exe
<SYSTEM32>\dllcache\tskill.exe
<SYSTEM32>\dllcache\tracert6.exe
<SYSTEM32>\dllcache\tintlphr.exe
<SYSTEM32>\dllcache\tourstrt.exe
<SYSTEM32>\dllcache\timer.drv
<SYSTEM32>\dllcache\tintsetp.exe
<SYSTEM32>\dllcache\tlntsess.exe
<SYSTEM32>\dllcache\tracerpt.exe
<SYSTEM32>\dllcache\tlntadmn.exe
<SYSTEM32>\dllcache\tlntsvr.exe
<SYSTEM32>\dllcache\uploadm.exe
<SYSTEM32>\dllcache\upnpcont.exe
<SYSTEM32>\dllcache\utilman.exe
<SYSTEM32>\dllcache\unsecapp.exe
<SYSTEM32>\dllcache\userinit.exe
<SYSTEM32>\dllcache\vga.drv
<SYSTEM32>\dllcache\user.exe
<SYSTEM32>\dllcache\usb8023.sys
<SYSTEM32>\dllcache\typeperf.exe
<SYSTEM32>\dllcache\twunk_32.exe
<SYSTEM32>\dllcache\twunk_16.exe
<SYSTEM32>\dllcache\udfs.sys
<SYSTEM32>\dllcache\update.sys
<SYSTEM32>\dllcache\ups.exe
<SYSTEM32>\dllcache\unlodctr.exe
<SYSTEM32>\dllcache\unregmp2.exe
<SYSTEM32>\dllcache\systray.exe
<SYSTEM32>\dllcache\system.drv
<SYSTEM32>\dllcache\sysocmgr.exe
<SYSTEM32>\dllcache\sysinfo.exe
<SYSTEM32>\dllcache\taskkill.exe
<SYSTEM32>\dllcache\taskmgr.exe
<SYSTEM32>\dllcache\tahomabd.ttf
<SYSTEM32>\dllcache\tape.sys
<SYSTEM32>\dllcache\syncapp.exe
<SYSTEM32>\dllcache\subst.exe
<SYSTEM32>\dllcache\sr.sys
<SYSTEM32>\dllcache\stimon.exe
<SYSTEM32>\dllcache\sysedit.exe
<SYSTEM32>\dllcache\syskey.exe
<SYSTEM32>\dllcache\svchost.exe
<SYSTEM32>\dllcache\tahoma.ttf
<SYSTEM32>\dllcache\telnet.exe
<SYSTEM32>\dllcache\tdspx.sys
<SYSTEM32>\dllcache\tcpsvcs.exe
<SYSTEM32>\dllcache\tdipx.sys
<SYSTEM32>\dllcache\tdtcp.sys
<SYSTEM32>\dllcache\tftp.exe
<SYSTEM32>\dllcache\tourW.exe
<SYSTEM32>\dllcache\tdi.sys
<SYSTEM32>\dllcache\tcpip6.sys
<SYSTEM32>\dllcache\tcmsetup.exe
<SYSTEM32>\dllcache\tcpip.sys
<SYSTEM32>\dllcache\tasklist.exe
<SYSTEM32>\dllcache\tdasync.sys
<SYSTEM32>\dllcache\tdpipe.sys
<SYSTEM32>\dllcache\taskman.exe
<SYSTEM32>\dllcache\tcptest.exe

Подменяет следующие исполняемые файлы:

<ANALYSETOOLS_DIR>\DbgPrint\EchoDbg.exe
<APATH_DUMPER_NET.EXE>
<ANALYSETOOLS_DIR>\BCode\bcode.exe
<ANALYSETOOLS_DIR>\XueTr_Cmd\PCHunter64.exe
<ANALYSETOOLS_DIR>\FileDisk\filedisk.exe
<ANALYSETOOLS_DIR>\FileDisk\filedisk.sys
<ANALYSETOOLS_DIR>\File\file.exe
<ANALYSETOOLS_DIR>\XueTr_Cmd\PCHunter32.exe
<ANALYSETOOLS_DIR>\DbgPrint\DbgPrnHk.sys
<ANALYSE_DIR>\dwshield.sys
<ANALYSETOOLS_DIR>\Angar2\tools\dumpe_\procdump64.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
<ANALYSETOOLS_DIR>\Angar2\tools\dumpe_\procdump32.exe
<ANALYSE_DIR>\muldrop.sys
<ANALYSETOOLS_DIR>\Angar2\tools\th_\thp.exe
<ANALYSETOOLS_DIR>\Angar2\custom_send.exe
<ANALYSE_DIR>\muldrop_dbg.sys
<ANALYSETOOLS_DIR>\NoExit\noexit.exe
<APATH_PROCDUMP.EXE>
<ANALYSETOOLS_DIR>\ProcDump\procdump64.exe
<ANALYSETOOLS_DIR>\MyNCAP_\kdump.exe
<ANALYSETOOLS_DIR>\XueTr_Cmd\XueTrSDK.sys
<ANALYSETOOLS_DIR>\XueTr_Cmd\XueTrCmdOrig.exe
<ANALYSETOOLS_DIR>\STracer\SimplyTracer.exe
<ANALYSETOOLS_DIR>\XueTr_Cmd\XueTrCmd.exe
<ANALYSETOOLS_DIR>\MemDump\memdump2.exe
<ANALYSETOOLS_DIR>\MyNCAP_\myncap.exe
<ANALYSETOOLS_DIR>\KDump\load.exe
<ANALYSETOOLS_DIR>\FileDisk\loaddrv.exe
<ANALYSETOOLS_DIR>\KDump\kdump.sys
<ANALYSETOOLS_DIR>\MinArk\minark.exe
<APATH_LOADLIB.EXE>
<ANALYSETOOLS_DIR>\MinArk\phunter.sys
<ANALYSETOOLS_DIR>\MyNCAP_\mpf.sys

Подменяет следующие файлы:

<ANALYSE_DIR>\AngarCl.ini
<ANALYSETOOLS_DIR>\Angar2\angar2.ini
<ANALYSETOOLS_DIR>\Angar2\tools\th_\thp.ini
<ANALYSETOOLS_DIR>\THP\thp.ini
<ANALYSETOOLS_DIR>\STracer\config.ini

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней