Trojan.KillFiles2.888

Техническая информация

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Компонент восстановления системы (SR)

Изменения в файловой системе

Создает следующие файлы

%TEMP%\28f.tmp\290.tmp\291.bat
<Текущая директория>\msgbox.vbs

Удаляет следующие файлы

<Текущая директория>\msgbox.vbs
<SYSTEM32>\spool\drivers\x64\3\en-us\hpfevw73.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpf4400t.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpd7500t.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpd5400t.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpd2600t.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpc6300t.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpfiew73.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpfiew71.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpc4600t.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpc4500t.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpc309at.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpb8500t.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hp8500nt.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hp8500gt.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpc5500t.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\kyw7fr04.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpfime50.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\kyw7fr02.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\ko0c0001.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\jnwdui.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpzuiwn7.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpzuiw71.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpzprwn7.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpzprw72.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpzprw71.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpzlswn7.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpzlawn7.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpzlaw71.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpzevwn7.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpzevw72.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpzevw71.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpz3awn7.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hp8500at.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpc5300t.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hpfprw73.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\kyw7fr03.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hp6500at.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_325.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_331.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_329.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_328.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_327.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_326.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_335.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_333.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_334.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_321.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_320.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_319.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_318.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_317.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_323.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_336.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hp6000nt.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hp6500nt.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_332.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hp6000at.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\fxucu001.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\fxsres.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\ep7uip00.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\ep7res01.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\ep7res00.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnn0b007.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_346.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_342.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_341.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_340.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_339.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_338.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_337.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\hp8000at.dll.mui
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw1
<SYSTEM32>\spool\drivers\x64\3\en-us\kyw7fres.dll.mui
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask-roam
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\systemtask
<SYSTEM32>\tasks\microsoft\windows\bluetooth\uninstalldevicetask
<SYSTEM32>\tasks\microsoft\windows\autochk\proxy
<SYSTEM32>\tasks\microsoft\windows\application experience\programdataupdater
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\consolidator
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\usbceip
<SYSTEM32>\tasks\microsoft\windows\application experience\aitagent
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (manual)
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (automated)
<SYSTEM32>\tasks\adobe flash player updater
<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\sysprep\panther\ie\setuperr.log
<SYSTEM32>\tasks\microsoft\windows\appid\verifiedpublishercertstorecheck
<SYSTEM32>\tasks\microsoft\windows\appid\policyconverter
<SYSTEM32>\spool\drivers\x64\3\en-us\lxkpclrs.dll.mui
<SYSTEM32>\tasks\microsoft\windows\defrag\scheduleddefrag
<SYSTEM32>\tasks\microsoft\windows\media center\ocuractivate
<SYSTEM32>\tasks\microsoft\windows\media center\objectstorerecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\mediacenterrecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\mcupdate
<SYSTEM32>\tasks\microsoft\windows\media center\installplayready
<SYSTEM32>\tasks\microsoft\windows\media center\ehdrminit
<SYSTEM32>\tasks\microsoft\windows\media center\dispatchrecoverytasks
<SYSTEM32>\tasks\microsoft\windows\media center\configureinternettimeservice
<SYSTEM32>\tasks\microsoft\windows\media center\activatewindowssearch
<SYSTEM32>\tasks\microsoft\windows\maintenance\winsat
<SYSTEM32>\tasks\microsoft\windows\location\notifications
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticresolver
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector
<SYSTEM32>\tasks\microsoft\windows\diagnosis\scheduled
<SYSTEM32>\sysprep\panther\ie\setupact.log
<SYSTEM32>\sysprep\panther\ie\diagwrn.xml
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\kernelceiptask
<SYSTEM32>\sysprep\panther\ie\diagerr.xml
<SYSTEM32>\spool\prtprocs\x64\en-us\lxkptprc.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\riaui17.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\okdtures.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\pscript5.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\ps5ui.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\pclxl.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\pcl5ures.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\pcl5eres.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\pcl4res.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\okdteres.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_316.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\ok9ibres.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\lxkxlui.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\lxkxlres.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\lxkpsui.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\lxkpclui.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\riaui27.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\ripsui7.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_324.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\sodppui2.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\sh_1_res.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\riares7.dll.mui
<SYSTEM32>\spool\prtprocs\x64\jnwppr.dll
<SYSTEM32>\spool\drivers\x64\pcc\prnms002.inf_amd64_neutral_d834e48846616289.cab
<SYSTEM32>\spool\drivers\x64\pcc\prnms002.inf_amd64_neutral_d439051ec90eeda4.cab
<SYSTEM32>\spool\drivers\x64\pcc\prnms001.inf_amd64_neutral_9fe8503f82ce60fa.cab
<SYSTEM32>\spool\drivers\x64\pcc\ntprint.inf_amd64_neutral_4616c3de1949be6d.cab
<SYSTEM32>\spool\drivers\x64\3\mui\0409\unidrv.hlp
<SYSTEM32>\spool\drivers\x64\3\mui\0409\ttyui.hlp
<SYSTEM32>\spool\drivers\x64\3\mui\0409\pscript.hlp
<SYSTEM32>\spool\drivers\x64\3\en-us\unires.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\unidrvui.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\ttyui.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\ttyres.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\tsprint.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\tsmxuui3.dll.mui
<SYSTEM32>\spool\prtprocs\x64\winprint.dll
<SYSTEM32>\tasks\microsoft\windows\media center\ocurdiscovery
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscovery
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_311.dll.mui
<SYSTEM32>\spool\drivers\x64\3\stdschem.gdl
<SYSTEM32>\spool\drivers\x64\3\unires.dll
<SYSTEM32>\spool\drivers\x64\3\unidrvui.dll
<SYSTEM32>\spool\drivers\x64\3\unidrv.hlp
<SYSTEM32>\spool\drivers\x64\3\unidrv.dll
<SYSTEM32>\spool\drivers\x64\3\stdschmx.gdl
<SYSTEM32>\spool\drivers\x64\3\en-us\brci14ui.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\brci06ui.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\brci08ui.dll.mui
<SYSTEM32>\spool\drivers\x64\3\sendtoonenoteui.dll
<SYSTEM32>\spool\drivers\x64\3\sendtoonenotenames.gpd
<SYSTEM32>\spool\drivers\x64\3\sendtoonenotefilter.gpd
<SYSTEM32>\spool\drivers\x64\3\sendtoonenotefilter.dll
<SYSTEM32>\spool\drivers\x64\3\sendtoonenote.ini
<SYSTEM32>\spool\drivers\x64\3\stddtype.gdl
<SYSTEM32>\spool\drivers\x64\3\en-us\brclui05.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr288.dll.mui
<SYSTEM32>\spool\drivers\x64\3\sendtoonenote.gpd
<SYSTEM32>\spool\drivers\x64\3\sendtoonenote.bud
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr286.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr285.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr284.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr283.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr282.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr281.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr280.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr276.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr274.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr273.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\bruui23a.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\brptui2.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\brmzui13.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\brclui06.dll.mui
<SYSTEM32>\spool\drivers\x64\3\stdnames.gpd
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr292.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr289.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr290.dll.mui
<SYSTEM32>\spool\drivers\x64\sendtoonenote.ini
<SYSTEM32>\spool\drivers\x64\stddtype.gdl
<SYSTEM32>\spool\drivers\x64\sendtoonenoteui.dll
<SYSTEM32>\spool\drivers\x64\sendtoonenotenames.gpd
<SYSTEM32>\spool\drivers\x64\sendtoonenotefilter.gpd
<SYSTEM32>\spool\drivers\x64\sendtoonenotefilter.dll
<SYSTEM32>\spool\drivers\x64\unidrv.dll
<SYSTEM32>\spool\drivers\x64\stdschem.gdl
<SYSTEM32>\spool\drivers\x64\stdschmx.gdl
<SYSTEM32>\spool\drivers\x64\mxdwdrv.dll
<SYSTEM32>\smi\store\machine\schema.dat
<SYSTEM32>\recovery\reagent.xml
<SYSTEM32>\networklist\icons\{919f6e32-477d-49b3-946e-62054a1ead91}_48.bin
<SYSTEM32>\networklist\icons\{919f6e32-477d-49b3-946e-62054a1ead91}_32.bin
<SYSTEM32>\spool\drivers\x64\sendtoonenote-pipelineconfig.xml
<SYSTEM32>\spool\drivers\x64\unidrv.hlp
<SYSTEM32>\spool\drivers\x64\3\mxdwdui.gpd
<SYSTEM32>\spool\drivers\x64\3\sendtoonenote-pipelineconfig.xml
<SYSTEM32>\spool\drivers\x64\stdnames.gpd
<SYSTEM32>\spool\drivers\x64\3\mxdwdui.dll
<SYSTEM32>\spool\drivers\x64\3\mxdwdui.bud
<SYSTEM32>\spool\drivers\x64\3\mxdwdrv.dll
<SYSTEM32>\spool\drivers\x64\3\jnwdui.dll
<SYSTEM32>\spool\drivers\x64\3\jnwdrv.dll
<SYSTEM32>\spool\drivers\x64\3\fxswzrd.dll
<SYSTEM32>\spool\drivers\x64\3\fxsui.dll
<SYSTEM32>\spool\drivers\x64\3\fxstiff.dll
<SYSTEM32>\spool\drivers\x64\3\fxsres.dll
<SYSTEM32>\spool\drivers\x64\3\fxsdrv.dll
<SYSTEM32>\spool\drivers\x64\3\fxsapi.dll
<SYSTEM32>\spool\drivers\x64\xpssvcs.dll
<SYSTEM32>\spool\drivers\x64\unires.dll
<SYSTEM32>\spool\drivers\x64\unidrvui.dll
<SYSTEM32>\spool\drivers\x64\3\mxdwdui.ini
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr293.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_284.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr323.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_287.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_283.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_282.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_281.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_280.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_279.dll.mui
<SYSTEM32>\spool\drivers\x64\3\xpssvcs.dll
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_285.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbpv4.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbpv3.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbpcomm.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbpc4_2.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbpc4_1.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbmr310.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_276.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_288.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_309.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbmr284.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_310.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_303.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_302.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_301.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_300.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_298.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_297.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_295.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_294.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_293.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_292.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_291.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_290.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_289.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbmr285.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_274.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_286.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbic4_8.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbic4_7.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr325.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr309.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr318.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr316.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr315.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr312.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr311.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr310.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr303.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_312.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr302.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr301.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr300.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr297.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr294.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr327.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbp_315.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbic4_6.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr328.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr320.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr319.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbic4_5.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbic4_4.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbic4_3.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbic4_2.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbic4_1.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr346.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr342.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr339.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr335.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr334.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr333.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr332.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr331.dll.mui
<SYSTEM32>\spool\drivers\x64\3\en-us\cnbbr326.dll.mui
<DRIVERS>\arcsas.sys
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw2
<SYSTEM32>\wbem\autorecover\faad7d567e76cab10704afd7c0488f23.mof
<SYSTEM32>\wbem\autorecover\f920e83e4677de19916c341defaeee0d.mof
<SYSTEM32>\wbem\autorecover\f81e6bebc3067c406e6c491608474198.mof
<SYSTEM32>\wbem\autorecover\f74c0cfa45be5d905c3adf2ec8bf9ea1.mof
<SYSTEM32>\wbem\autorecover\f019c9391a5436446565e5387f8d40f3.mof
<SYSTEM32>\wbem\autorecover\f01326692cc5736ebac31b9fc2381cf2.mof
<SYSTEM32>\wbem\autorecover\fe978d9b7a5e71d84cfcda0f2efbdbf2.mof
<SYSTEM32>\wbem\logs\wmiprov.log
<SYSTEM32>\wbem\autorecover\efa4d91d0b8f053f62013a71d9f8dbe7.mof
<SYSTEM32>\wbem\autorecover\edb534a0ad75cf6cd3441c25046b8e9a.mof
<SYSTEM32>\wbem\autorecover\ed8983df8eb9b40d35ccec0672b73c02.mof
<SYSTEM32>\wbem\autorecover\ec45c70f2a3d9ded718e71631c38e2fe.mof
<SYSTEM32>\wbem\autorecover\e737de61441445e1fdfca45ef5e7d987.mof
<SYSTEM32>\wbem\autorecover\e6195ba9e153534e5472835e2f29a5b0.mof
<SYSTEM32>\wbem\autorecover\edbf963fb003d0670aa9c2219bd091fb.mof
<SYSTEM32>\wbem\autorecover\edb67a550428bb2a8dbda687d67bede0.mof
<SYSTEM32>\wdi\perftrack\displayswitch.ptxml
<SYSTEM32>\wbem\performance\wmiaprpl.h
<SYSTEM32>\wdi\perftrack\deviceux.ptxml
<SYSTEM32>\wdi\perftrack\core-fundamentals-clientperformance-perftrack.ptxml
<SYSTEM32>\wdi\perftrack\comdlg32.ptxml
<SYSTEM32>\wdi\perftrack\authui.ptxml
<SYSTEM32>\wdi\perftrack\appinfoevents.ptxml
<SYSTEM32>\wdi\perftrack\alttab.ptxml
<SYSTEM32>\wdi\logfiles\wdicontextlog.etl.003
<SYSTEM32>\wdi\logfiles\wdicontextlog.etl.002
<SYSTEM32>\wdi\logfiles\wdicontextlog.etl.001
<SYSTEM32>\wdi\logfiles\shutdownckcl.etl
<SYSTEM32>\wdi\logfiles\bootckcl.etl
<SYSTEM32>\wdi\shutdownperformancediagnostics_systemdata.bin
<SYSTEM32>\wdi\bootperformancediagnostics_systemdata.bin
<SYSTEM32>\wbem\performance\wmiaprpl.ini
<SYSTEM32>\wbem\autorecover\e43b6945acf1515a895841af9b9d052d.mof
<SYSTEM32>\wdi\perftrack\diagcpl.events.ptxml
<SYSTEM32>\wbem\autorecover\fedcf0c5e194376cbd64963452f9a8e1.mof
<SYSTEM32>\wdi\perftrack\dhcpclientdll.ptxml
<SYSTEM32>\wbem\autorecover\e202116242f1882d9b7334ba3590782d.mof
<SYSTEM32>\wbem\autorecover\c848e1eed73b9992693eedd7389e07f8.mof
<SYSTEM32>\wbem\autorecover\be81b2c0741907c1fc1c42b6223e59ad.mof
<SYSTEM32>\wbem\autorecover\c81acf420917aa0f87487bc4d958beb4.mof
<SYSTEM32>\wbem\autorecover\c6300bfe37ade6b52ec023f66124985f.mof
<SYSTEM32>\wbem\autorecover\c599afa5a6f053bad70179501868318e.mof
<SYSTEM32>\wbem\autorecover\c59549b4f20bc001a0a645775ab7be45.mof
<SYSTEM32>\wbem\autorecover\c9d18202aa357a22c174fcbbaa8afc56.mof
<SYSTEM32>\wbem\autorecover\d03c2ae022def1f4fa41826f3f82f3f6.mof
<SYSTEM32>\wbem\autorecover\c3f053947c9c22b6aec644e83defc5d2.mof
<SYSTEM32>\wbem\autorecover\cf8c0786491b25e81eaf9cd909af06ea.mof
<SYSTEM32>\wbem\autorecover\bbc8e4a673bf0f9776afb59b78f6037e.mof
<SYSTEM32>\wbem\autorecover\b3d1279cf76b72d4874d43a6ef458ef8.mof
<SYSTEM32>\wbem\autorecover\ae7023598f41510bf261111652046301.mof
<SYSTEM32>\wbem\autorecover\ad27078eb452d9411cd733b764d61fdf.mof
<SYSTEM32>\wbem\autorecover\c3a0be17b37ace48be78b31580231ae9.mof
<SYSTEM32>\wbem\autorecover\bbf206490baa431b592f9a13534f43f6.mof
<SYSTEM32>\wbem\autorecover\df80fd3849fff74b4bf43e2ea8adec8a.mof
<SYSTEM32>\wbem\autorecover\df2fb1f3c8dcd25b01fde5a4697177cb.mof
<SYSTEM32>\wdi\perftrack\display.ptxml
<SYSTEM32>\wbem\autorecover\c8463ecbe33bc240263a0b094e46d510.mof
<SYSTEM32>\wbem\autorecover\dc999686f8b85b326cedfa199dd07f72.mof
<SYSTEM32>\wbem\autorecover\dbeb89ffb44f7953fe6991f49b1381a7.mof
<SYSTEM32>\wbem\autorecover\d97d08e4902ac1bcf40c06435990ed69.mof
<SYSTEM32>\wbem\autorecover\d5d6bb480217f9dcec357f57222dee59.mof
<SYSTEM32>\wbem\autorecover\d4c4ba54b6a8fa6211e60e2adff7426a.mof
<SYSTEM32>\wbem\autorecover\d38ffa40ec29a055eb37ebd604093c62.mof
<SYSTEM32>\wbem\autorecover\d361f8b496fd6daf7beef497e09c0dc1.mof
<SYSTEM32>\wbem\autorecover\d301c164804127cdbb49abff977c2826.mof
<SYSTEM32>\wbem\autorecover\d1a1b12a7da3f9675c01397a26dbf4b3.mof
<SYSTEM32>\wbem\autorecover\d1268853acd6074f8748a58e20c039a9.mof
<SYSTEM32>\wbem\autorecover\d0f718f60c57daa7f0d86ae75eadaeec.mof
<SYSTEM32>\wbem\autorecover\d0af13028629a5f0ccb192c1731c5791.mof
<SYSTEM32>\wbem\autorecover\d04cf75cf95177478d7a2ab8ba487705.mof
<SYSTEM32>\wbem\autorecover\e04de4cdfec284a342159bb920976701.mof
<SYSTEM32>\wbem\autorecover\df8bf6b131e93d11c67d810b1aae1bc3.mof
<SYSTEM32>\tasks\microsoft\windows\media center\periodicscanretry
<SYSTEM32>\wdi\perftrack\driverframeworks-usermode.ptxml
<SYSTEM32>\winevt\logs\microsoft-windows-bits-client%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-application server-applications%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-application server-applications%4admin.evtx
<SYSTEM32>\winevt\logs\debugchannel.etl
<SYSTEM32>\windowspowershell\v1.0\modules\psdiagnostics\psdiagnostics.psm1
<SYSTEM32>\winevt\logs\microsoft-windows-capi2%4operational.evtx
<SYSTEM32>\windowspowershell\v1.0\modules\psdiagnostics\psdiagnostics.psd1
<SYSTEM32>\winevt\logs\microsoft-windows-diskdiagnosticdatacollector%4operational.evtx
<SYSTEM32>\wfp\wfpdiag.etl
<SYSTEM32>\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{0d4db5ee-11f7-4631-bf38-96a10f046312}\snapshot.etl
<SYSTEM32>\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\s-1-5-21-3111613574-2524581245-2586426736-500_userdata.bin
<SYSTEM32>\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\s-1-5-21-1960123792-2022915161-3775307078-1001_userdata.bin
<SYSTEM32>\wdi\perftrack\wpdcoreinstrumentation.ptxml
<SYSTEM32>\windowspowershell\v1.0\examples\profile.ps1
<SYSTEM32>\winevt\logs\microsoft-windows-codeintegrity%4operational.evtx
<SYSTEM32>\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{f5347364-e11d-49a6-a2a7-8998e3a51d45}\snapshot.etl
<SYSTEM32>\winevt\logs\microsoft-windows-branchcachesmb%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-windows defender%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-resource-exhaustion-resolver%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-remoteassistance%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-remoteassistance%4admin.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-reliabilityanalysiscomponent%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-readyboost%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-printservice%4admin.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-offlinefiles%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-networklocationwizard%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-mui%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-mui%4admin.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-languagepacksetup%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-known folders api service.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-homegroup provider service%4operational.evtx
<SYSTEM32>\wdi\perftrack\wlansvc.ptxml
<SYSTEM32>\wdi\perftrack\winlogonevents.ptxml
<SYSTEM32>\wdi\perftrack\wininet.etw.ptxml
<SYSTEM32>\winevt\logs\microsoft-windows-diagnosis-pla%4operational.evtx
<SYSTEM32>\wdi\perftrack\wdc.events.ptxml
<SYSTEM32>\wdi\perftrack\networkconnectionsfolder.ptxml
<SYSTEM32>\wdi\perftrack\msdt.events.ptxml
<SYSTEM32>\wdi\perftrack\ieframe.ptxml
<SYSTEM32>\wdi\perftrack\microsoft-windows-van.ptxml
<SYSTEM32>\wdi\perftrack\microsoft-windows-tabletpc-inputpanel-events.ptxml
<SYSTEM32>\wdi\perftrack\microsoft-windows-ncsi.ptxml
<SYSTEM32>\wdi\perftrack\microsoft-windows-ie-htmlrendering.ptxml
<SYSTEM32>\wdi\perftrack\microsoft-windows-documents-events.ptxml
<SYSTEM32>\wdi\perftrack\lddmcore.ptxml
<SYSTEM32>\wdi\perftrack\help-datalayer.ptxml
<SYSTEM32>\wdi\perftrack\networkprofile.ptxml
<SYSTEM32>\wdi\perftrack\healthcenterinstrumentation.ptxml
<SYSTEM32>\wdi\perftrack\healthcentercplinstrumentation.ptxml
<SYSTEM32>\wdi\perftrack\errorreportingconsole.ptxml
<SYSTEM32>\wdi\perftrack\dxp-deviceexperience.ptxml
<SYSTEM32>\wdi\perftrack\networkdiagnosticsframework.ptxml
<SYSTEM32>\wbem\autorecover\ad1621c948a4e41c8abe8fc09ac11633.mof
<SYSTEM32>\wdi\perftrack\powercpl.ptxml
<SYSTEM32>\wbem\autorecover\cf881ebd6f50b8baa9bd57dc3dac5cb2.mof
<SYSTEM32>\wdi\perftrack\volumecontrol.ptxml
<SYSTEM32>\wbem\autorecover\ad0b790c2468a8dcf73e8e2925527653.mof
<SYSTEM32>\wdi\perftrack\microsoft-windows-wlanconnectionflow.ptxml
<SYSTEM32>\wdi\perftrack\uiautomationcore.ptxml
<SYSTEM32>\wdi\perftrack\timedate.ptxml
<SYSTEM32>\wdi\perftrack\themecpl.ptxml
<SYSTEM32>\wdi\perftrack\taskmgr.events.ptxml
<SYSTEM32>\wdi\perftrack\stobjectinstrumentation.ptxml
<SYSTEM32>\wdi\perftrack\spux.ptxml
<SYSTEM32>\wdi\perftrack\sidebar.ptxml
<SYSTEM32>\wdi\perftrack\shellcoreinstrumentation.ptxml
<SYSTEM32>\wdi\perftrack\services.ptxml
<SYSTEM32>\wdi\perftrack\provsvc.ptxml
<SYSTEM32>\wdi\perftrack\profsvc.ptxml
<SYSTEM32>\wdi\perftrack\prod_wmpplayer.ptxml
<SYSTEM32>\wdi\perftrack\prod_audio-audiocore.ptxml
<SYSTEM32>\wdi\perftrack\nlasvc.ptxml
<SYSTEM32>\wdi\perftrack\userplugplayetw.ptxml
<SYSTEM32>\wbem\autorecover\acb4d7f86fec98f3823883b78d5bc4f2.mof
<SYSTEM32>\wbem\autorecover\ac7364db8095313cd61cf47141af3f0b.mof
<SYSTEM32>\wbem\autorecover\088f2bf65584eea866644bc7f977eff8.mof
<SYSTEM32>\tasks\officesoftwareprotectionplatform\svcrestarttask
<SYSTEM32>\wbem\autorecover\070646108bd2e03a20d78b04d8233ff3.mof
<SYSTEM32>\wbem\autorecover\0685dc0c8684127be5deff585fdd8fec.mof
<SYSTEM32>\wbem\autorecover\0296c47314ab746ec35476488248fcd9.mof
<SYSTEM32>\wbem\autorecover\0268b349fb528f7a876a79de14717b95.mof
<SYSTEM32>\wbem\autorecover\092389d621f5a8834203daac74cca279.mof
<SYSTEM32>\wbem\autorecover\14c5a2a3c41254184b007011e5565e5b.mof
<SYSTEM32>\wbem\servicemodel.mof.uninstall
<SYSTEM32>\wbem\autorecover\0af2d09c9745e5fa1ec76370242d29c9.mof
<SYSTEM32>\tasks\microsoft\windows\windowscolorsystem\calibration loader
<SYSTEM32>\tasks\microsoft\windows\windowsbackup\confignotification
<SYSTEM32>\tasks\microsoft\windows\windows media sharing\updatelibrary
<SYSTEM32>\tasks\microsoft\windows\windows filtering platform\bfeonservicestarttypechange
<SYSTEM32>\wbem\servicemodel.mof
<SYSTEM32>\tasks\microsoft\windows defender\mp scheduled scan
<SYSTEM32>\wbem\autorecover\2ce523184a801aa7361a7039e2d6b41d.mof
<SYSTEM32>\wbem\autorecover\2c142c4c15e3b8d139b98154cd083071.mof
<SYSTEM32>\tasks\microsoft\windows\wdi\resolutionhost
<SYSTEM32>\tasks\microsoft\windows\upnp\upnphostconfig
<SYSTEM32>\wbem\autorecover\2b8b1a8b0acd3ee28b421d3918dc1f29.mof
<SYSTEM32>\wbem\autorecover\2aa23bb86a5ebd8bc2d820944e55b233.mof
<SYSTEM32>\wbem\autorecover\2a05e3f4c9132fdf73bb3d12f6886f31.mof
<SYSTEM32>\wbem\autorecover\2713ef0312125b926ec10d64c17dc18a.mof
<SYSTEM32>\wbem\autorecover\26c097a9392f8c541ad42e89b7909073.mof
<SYSTEM32>\wbem\autorecover\26a5a04a346330e389400293e01228ac.mof
<SYSTEM32>\wbem\autorecover\26869dc91cc97fbae032bea74b1f7ab8.mof
<SYSTEM32>\wbem\autorecover\22bd4e705855faece7ffab23c49d3662.mof
<SYSTEM32>\wbem\autorecover\20133bc3ffa56bbcd6a1356879d9b41e.mof
<SYSTEM32>\wbem\autorecover\1e97a05de566cf6eeae29d0634e27392.mof
<SYSTEM32>\wbem\autorecover\1ba88acb624e02a260404a9d8f7bd8e5.mof
<SYSTEM32>\wbem\autorecover\17ffdf80330024b07853138cb5afad9c.mof
<SYSTEM32>\wbem\autorecover\14cd238acdcf64feffb0cbd55e8e7adc.mof
<SYSTEM32>\tasks\microsoft\windows\windows error reporting\queuereporting
<SYSTEM32>\wbem\autorecover\0a9dbc92d554324656f61f9862679f27.mof
<SYSTEM32>\tasks\microsoft\windows\user profile service\hiveuploadtask
<SYSTEM32>\tasks\microsoft\windows\offline files\logon synchronization
<SYSTEM32>\networklist\icons\{919f6e32-477d-49b3-946e-62054a1ead91}_24.bin
<SYSTEM32>\tasks\microsoft\windows\media center\updaterecordpath
<SYSTEM32>\tasks\microsoft\windows\nettrace\gathernetworkinfo
<SYSTEM32>\tasks\microsoft\windows\multimedia\systemsoundsservice
<SYSTEM32>\tasks\microsoft\windows\mui\lpremove
<SYSTEM32>\tasks\microsoft\windows\mobilepc\hotstart
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\decompressionfailuredetector
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\corruptiondetector
<SYSTEM32>\tasks\microsoft\windows\media center\sqlliterecoverytask
<SYSTEM32>\wbem\autorecover\2cfb5b149fa396d1aea5f89b1c5a8d81.mof
<SYSTEM32>\tasks\microsoft\windows\media center\reindexsearchroot
<SYSTEM32>\tasks\microsoft\windows\media center\registersearch
<SYSTEM32>\tasks\microsoft\windows\media center\recordingrestart
<SYSTEM32>\tasks\microsoft\windows\media center\pvrscheduletask
<SYSTEM32>\tasks\microsoft\windows\media center\pvrrecoverytask
<SYSTEM32>\tasks\microsoft\windows\perftrack\backgroundconfigsurveyor
<SYSTEM32>\tasks\microsoft\windows\power efficiency diagnostics\analyzesystem
<SYSTEM32>\wbem\autorecover\321f79808e7c79bd91941c94e53929eb.mof
<SYSTEM32>\tasks\microsoft\windows\ras\mobilitymanager
<SYSTEM32>\tasks\microsoft\windows\rac\ractask
<SYSTEM32>\tasks\microsoft\windows\offline files\background synchronization
<SYSTEM32>\tasks\microsoft\windows\textservicesframework\msctfmonitor
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict2
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict1
<SYSTEM32>\tasks\microsoft\windows\task manager\interactive
<SYSTEM32>\tasks\microsoft\windows\systemrestore\sr
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask
<SYSTEM32>\tasks\microsoft\windows\sideshow\systemdataproviders
<SYSTEM32>\tasks\microsoft\windows\sideshow\sessionagent
<SYSTEM32>\tasks\microsoft\windows\sideshow\gadgetmanager
<SYSTEM32>\tasks\microsoft\windows\sideshow\autowake
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrolsmigration
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrols
<SYSTEM32>\tasks\microsoft\windows\remoteassistance\remoteassistancetask
<SYSTEM32>\tasks\microsoft\windows\registry\regidlebackup
<SYSTEM32>\tasks\microsoft\windows\time synchronization\synchronizetime
<SYSTEM32>\spool\drivers\x64\sendtoonenote.gpd
<SYSTEM32>\wbem\autorecover\32c943873cc624333bd0bf2a77384240.mof
<SYSTEM32>\wbem\autorecover\4a01e0f376b5833eba98f0d1d5f60cd1.mof
<SYSTEM32>\wbem\autorecover\941dcf248ec1d3f6b717f53e6f950a65.mof
<SYSTEM32>\wbem\autorecover\8ba265a7154f292011e74f9b0803bacc.mof
<SYSTEM32>\wbem\autorecover\88744d2a29102fc88ecf505dd2e984fc.mof
<SYSTEM32>\wbem\autorecover\87aa2a001ce3e89926688b93e4dc2992.mof
<SYSTEM32>\wbem\autorecover\8636dc7f9479dace6778109cb4fb4b01.mof
<SYSTEM32>\wbem\autorecover\8528bab554033eda3a4ea8ddaf8f3598.mof
<SYSTEM32>\wbem\autorecover\0772ea28c9ad9f026aa9f29ee684b717.mof
<SYSTEM32>\wbem\autorecover\903e49c444c46fef5f2c3a189c9cef71.mof
<SYSTEM32>\wbem\autorecover\7f417e1a6d819a9b2feb55da6858ea0a.mof
<SYSTEM32>\wbem\autorecover\7f269e749abffbdb9d9cdee2b0a41aaf.mof
<SYSTEM32>\wbem\autorecover\7df0eb3c2e6d82bfea2f9230107d2e75.mof
<SYSTEM32>\wbem\autorecover\7c45c8b7490d3ad44a961494c7fbfafd.mof
<SYSTEM32>\wbem\autorecover\77af494807bb41a0b4b67aeec51f85c6.mof
<SYSTEM32>\wbem\autorecover\779e080b33f322115205bb50f1e0b8d1.mof
<SYSTEM32>\wbem\autorecover\844a429fb6680a32838047a6271f8cd9.mof
<SYSTEM32>\wbem\autorecover\95cf8c2673b156e93407c44da1171f14.mof
<SYSTEM32>\wbem\autorecover\a9325a7fc13ee1821f6bc28637472fc3.mof
<SYSTEM32>\wbem\autorecover\73798c03e4de5fdcf5194ada9ebfb859.mof
<SYSTEM32>\wbem\autorecover\aa742824dcada846ba4b665d686dd5d6.mof
<SYSTEM32>\wbem\autorecover\a87fd967e816cb9c37f3ddd9d2d5c42a.mof
<SYSTEM32>\wbem\autorecover\a851d3bcfce697c24e7112d24afbe9e3.mof
<SYSTEM32>\wbem\autorecover\a7575f8de31a912ffe91a7a41b1e382a.mof
<SYSTEM32>\wbem\autorecover\a3c60c5e59327eb453eaa631b41ae407.mof
<SYSTEM32>\wbem\autorecover\a1fdfdc2dd7b0c64bcde5816a23bb0b2.mof
<SYSTEM32>\wbem\autorecover\a0925b7cae67304db8a7d8b009b810d1.mof
<SYSTEM32>\wbem\autorecover\a070e510dd6fb900742044f2cd306750.mof
<SYSTEM32>\wbem\autorecover\9f02cc08c7f26fe46495b38730e2c1cb.mof
<SYSTEM32>\wbem\autorecover\9d6dc6d14f2c168d63b2b58aa6cb3f86.mof
<SYSTEM32>\wbem\autorecover\9ad3182a2f39a3e091e15109132ec6cc.mof
<SYSTEM32>\wbem\autorecover\97823dc673ad0f92ab9b83f4c177678b.mof
<SYSTEM32>\wbem\autorecover\973858e80f1da2ca957fccd54f9b65f4.mof
<SYSTEM32>\wbem\autorecover\96abb1671705f680578fe240427cbd4f.mof
<SYSTEM32>\wbem\autorecover\75054c3771df289038069a9bb1c1fb6e.mof
<SYSTEM32>\wbem\autorecover\8248f723bbfe53441db78bb98e9c7b04.mof
<SYSTEM32>\wbem\autorecover\933d58ad5eed665c88f25a10903603b4.mof
<SYSTEM32>\wbem\autorecover\72f867ef62976ce9f70993ff3e68a4eb.mof
<SYSTEM32>\wbem\autorecover\716fdc254e211f547a560e1a71d0e6ca.mof
<SYSTEM32>\wbem\autorecover\4b3b0b9371e89215c02d5e6bef817802.mof
<SYSTEM32>\wbem\autorecover\3fa3650b664bc96a8672ec85a7ae4225.mof
<SYSTEM32>\wbem\autorecover\440d61aff6e7de917af4be1c22d9d054.mof
<SYSTEM32>\wbem\autorecover\43af8f4749656456f363eca1d9b30b00.mof
<SYSTEM32>\wbem\autorecover\43a7eee279f15546ee900076ca8cc2c8.mof
<SYSTEM32>\wbem\autorecover\42c894eeacad83a4e41154685841b3e1.mof
<SYSTEM32>\wbem\autorecover\42355e8e232ef8cadd187d531dec55dd.mof
<SYSTEM32>\wbem\autorecover\41648fa3af58f3aca0843f25fc7b4d28.mof
<SYSTEM32>\wbem\autorecover\3edc3f5a95d3a0fdfe1f87c15dc9636a.mof
<SYSTEM32>\wbem\autorecover\327bb52c3180f103242f79f3fb946560.mof
<SYSTEM32>\wbem\autorecover\3e2eea84b9c48dacd55f3e7ef12ac696.mof
<SYSTEM32>\wbem\autorecover\3dc0babdca20e5e319117c21bd4bd795.mof
<SYSTEM32>\wbem\autorecover\38ee6c630467a006990c5977c3058c94.mof
<SYSTEM32>\wbem\autorecover\37134956f76d3c30c9be0c12571caf43.mof
<SYSTEM32>\wbem\autorecover\341285245f81aa74fe6654017e06c685.mof
<SYSTEM32>\wbem\autorecover\50a61596e5c5ece8862eae9a241e4d56.mof
<SYSTEM32>\wbem\autorecover\8c718b5afd373885b68d2836088caf9a.mof
<SYSTEM32>\wbem\autorecover\7073ebb8e2f3c70e0fa1f650b7dea970.mof
<SYSTEM32>\wbem\autorecover\518c51c612f4af81e609ec0d5cf027e1.mof
<SYSTEM32>\wbem\autorecover\494c62faa08cd5217399baa555ff491b.mof
<SYSTEM32>\wbem\autorecover\451233ed13e097000776690b79d8d753.mof
<SYSTEM32>\wbem\autorecover\6fff7467a5b40765d5740a413ca8bb8a.mof
<SYSTEM32>\wbem\autorecover\6f8564a71977ae6b940705dcc4847a8d.mof
<SYSTEM32>\wbem\autorecover\6f09c6fb03c02f6e4834d78c451f4681.mof
<SYSTEM32>\wbem\autorecover\690bd80ae2dee5e3fba4442c95b7c5b1.mof
<SYSTEM32>\wbem\autorecover\6792fda793556851bd20ea3dd8bd4f6b.mof
<SYSTEM32>\wbem\autorecover\64b9ca5d02571c3a5d29106d06c491dc.mof
<SYSTEM32>\wbem\autorecover\6317f4b515bd547512ff3ae3acd81242.mof
<SYSTEM32>\wbem\autorecover\5fe81f25d4d51d8c38065e285f42f0bf.mof
<SYSTEM32>\wbem\autorecover\5b5d21cf62e70bacf9d085e6aa6ce143.mof
<SYSTEM32>\wbem\autorecover\5966d45c7b25eaca46e87dd8e5703964.mof
<SYSTEM32>\wbem\autorecover\57b0d59999df0a672e8cdb1626320ac0.mof
<SYSTEM32>\wbem\autorecover\56110eee7f067a75407d9f58f62f7e1d.mof
<SYSTEM32>\wbem\autorecover\542dc56d520fddeda279a0d2f398203d.mof
<SYSTEM32>\wbem\autorecover\4d63dbc2e2f583689fbd5757de239e05.mof
<SYSTEM32>\networklist\icons\{919f6e32-477d-49b3-946e-62054a1ead91}_16.bin
<SYSTEM32>\msdtc\trace\dtctrace.log
<SYSTEM32>\msdtc\msdtc.log
<SYSTEM32>\vmicres.dll
<SYSTEM32>\x264vfw64.dll
<SYSTEM32>\windowsaccessbridge-64.dll
<SYSTEM32>\vmstorfltres.dll
<SYSTEM32>\vmictimeprovider.dll
<SYSTEM32>\vmicsvc.exe
<SYSTEM32>\x3daudio1_3.dll
<SYSTEM32>\x3daudio1_1.dll
<SYSTEM32>\x3daudio1_2.dll
<SYSTEM32>\vmbuspipe.dll
<SYSTEM32>\vmbuscoinstaller.dll
<SYSTEM32>\ven2232.olb
<SYSTEM32>\vcruntime140d.dll
<SYSTEM32>\vcruntime140.dll
<SYSTEM32>\vmbusres.dll
<SYSTEM32>\x3daudio1_4.dll
<SYSTEM32>\xactengine3_0.dll
<SYSTEM32>\vcomp140.dll
<SYSTEM32>\vcomp120.dll
<SYSTEM32>\xactengine2_9.dll
<SYSTEM32>\xactengine2_8.dll
<SYSTEM32>\xactengine2_7.dll
<SYSTEM32>\xactengine2_6.dll
<SYSTEM32>\xactengine2_5.dll
<SYSTEM32>\xactengine2_4.dll
<SYSTEM32>\xactengine2_3.dll
<SYSTEM32>\xactengine2_2.dll
<SYSTEM32>\xactengine2_10.dll
<SYSTEM32>\xactengine2_1.dll
<SYSTEM32>\xactengine2_0.dll
<SYSTEM32>\x3daudio1_7.dll
<SYSTEM32>\x3daudio1_6.dll
<SYSTEM32>\x3daudio1_5.dll
<SYSTEM32>\vmdcoinstall.dll
<SYSTEM32>\xactengine3_3.dll
<SYSTEM32>\xactengine3_1.dll
<SYSTEM32>\xactengine3_2.dll
<SYSTEM32>\noise.chs
<SYSTEM32>\perfc009.dat
<SYSTEM32>\noise.tha
<SYSTEM32>\noise.kor
<SYSTEM32>\noise.dat
<SYSTEM32>\noise.cht
<SYSTEM32>\perfstringbackup.ini
<SYSTEM32>\perfh009.dat
<SYSTEM32>\perfi009.dat
<SYSTEM32>\msvcr120_clr0400.dll
<SYSTEM32>\msvcr120d.dll
<SYSTEM32>\msvcr120.dll
<SYSTEM32>\msvcr110_clr0400.dll
<SYSTEM32>\msvcr110d.dll
<SYSTEM32>\msvcr90d.dll
<SYSTEM32>\richtx32.ocx
<SYSTEM32>\vccorlib140d.dll
<SYSTEM32>\vcomp110.dll
<SYSTEM32>\perfd009.dat
<SYSTEM32>\vccorlib140.dll
<SYSTEM32>\vccorlib120d.dll
<SYSTEM32>\vccorlib120.dll
<SYSTEM32>\vccorlib110d.dll
<SYSTEM32>\vccorlib110.dll
<SYSTEM32>\vcamp140.dll
<SYSTEM32>\vcamp120.dll
<SYSTEM32>\vcamp110.dll
<SYSTEM32>\vbame.dll
<SYSTEM32>\umstartup000.etl
<SYSTEM32>\umstartup.etl
<SYSTEM32>\ucrtbased.dll
<SYSTEM32>\ticrf.rat
<SYSTEM32>\streamci.dll
<SYSTEM32>\vcomp100.dll
<SYSTEM32>\xactengine3_4.dll
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00e.cat
<SYSTEM32>\xaudio2_6.dll
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00h.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00d.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00c.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00b.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00a.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca003.cat
<SYSTEM32>\msvcr100d.dll
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00f.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnbr008.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnbr007.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnbr006.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnbr005.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnbr004.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnbr003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnbr00a.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00i.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep00g.cat
<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_KB2534111~31bf3856ad364e35~amd64~~6.1.1.0.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep00l.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep00f.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep00e.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep00d.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep00c.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep00b.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep00a.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep005.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep004.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnep002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00z.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00y.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00x.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnbr002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnbr009.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnca00g.cat
<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_KB2534111_SP1~31bf3856ad364e35~amd64~~6.1.1.0.cat
<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1_for_KB2534111~31bf3856ad364e35~amd64~~6.1.1.0.cat
<SYSTEM32>\xaudio2_7.dll
<SYSTEM32>\xapofx1_3.dll
<SYSTEM32>\xaudio2_3.dll
<SYSTEM32>\xaudio2_2.dll
<SYSTEM32>\xaudio2_1.dll
<SYSTEM32>\xaudio2_0.dll
<SYSTEM32>\xapofx1_5.dll
<SYSTEM32>\xapofx1_4.dll
<SYSTEM32>\xapofx1_2.dll
<SYSTEM32>\msvcr110.dll
<SYSTEM32>\xapofx1_1.dll
<SYSTEM32>\xapofx1_0.dll
<SYSTEM32>\xactengine3_7.dll
<SYSTEM32>\xactengine3_6.dll
<SYSTEM32>\xactengine3_5.dll
<SYSTEM32>\xinput1_2.dll
<SYSTEM32>\network_llu.log
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\ntprint.cat
<SYSTEM32>\xinput1_3.dll
<SYSTEM32>\xaudio2_5.dll
<SYSTEM32>\xaudio2_4.dll
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\ntph.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\ntpe.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\ntexe.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\nt5.cat
<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Security-SPP-Component-SKU-Enterprise-GVLK-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat
<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-LocalPack-ZA-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat
<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-LocalPack-US-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat
<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-LocalPack-GB-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat
<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-LocalPack-CA-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat
<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-LocalPack-AU-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat
<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Refresh-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.cat
<SYSTEM32>\xvidvfw.dll
<SYSTEM32>\xvidcore.dll
<SYSTEM32>\xinput1_1.dll
<SYSTEM32>\msvcr100_clr0400.dll
<SYSTEM32>\msvcr100.dll
<SYSTEM32>\mfc110fra.dll
<SYSTEM32>\d3dx9_34.dll
<SYSTEM32>\d3dx9_39.dll
<SYSTEM32>\d3dx9_38.dll
<SYSTEM32>\d3dx9_37.dll
<SYSTEM32>\d3dx9_36.dll
<SYSTEM32>\d3dx9_35.dll
<SYSTEM32>\d3dx9_43.dll
<SYSTEM32>\d3dx9_41.dll
<SYSTEM32>\d3dx9_42.dll
<SYSTEM32>\d3dx9_31.dll
<SYSTEM32>\d3dx9_30.dll
<SYSTEM32>\d3dx9_29.dll
<SYSTEM32>\d3dx9_28.dll
<SYSTEM32>\d3dx9_27.dll
<SYSTEM32>\d3dx9_32.dll
<SYSTEM32>\dll64.dll
<SYSTEM32>\lagarith.dll
<SYSTEM32>\d3dx9_26.dll
<SYSTEM32>\d3dx9_24.dll
<SYSTEM32>\korwbrkr.lex
<SYSTEM32>\javaws.exe
<SYSTEM32>\javaw.exe
<SYSTEM32>\java.exe
<SYSTEM32>\iscsilog.dll
<SYSTEM32>\installpackage_etw.log
<SYSTEM32>\icrav03.rat
<SYSTEM32>\iccoinstall.dll
<SYSTEM32>\fntcache.dat
<SYSTEM32>\fm20enu.dll
<SYSTEM32>\fm20.dll
<SYSTEM32>\ff_vfw.dll
<SYSTEM32>\dssec.dat
<SYSTEM32>\dmvscres.dll
<SYSTEM32>\d3dx9_33.dll
<SYSTEM32>\d3dx9_25.dll
<SYSTEM32>\d3dx11_43.dll
<SYSTEM32>\d3dcompiler_42.dll
<SYSTEM32>\concrt140d.dll
<SYSTEM32>\d3dcompiler_38.dll
<SYSTEM32>\d3dcompiler_37.dll
<SYSTEM32>\d3dcompiler_36.dll
<SYSTEM32>\d3dcompiler_35.dll
<SYSTEM32>\d3dcompiler_34.dll
<SYSTEM32>\d3dcompiler_33.dll
<SYSTEM32>\concrt140.dll
<SYSTEM32>\d3dcompiler_40.dll
<SYSTEM32>\circoinst.dll
<SYSTEM32>\brcoinst.dll
<SYSTEM32>\atl110.dll
<SYSTEM32>\atl100.dll
<SYSTEM32>\aspnet_counters.dll
<SYSTEM32>\ac3acm.acm
<SYSTEM32>\license.rtf
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnfx002.cat
<SYSTEM32>\d3dcompiler_41.dll
<SYSTEM32>\d3dcsx_42.dll
<SYSTEM32>\d3dcompiler_39.dll
<SYSTEM32>\d3dx11_42.dll
<SYSTEM32>\d3dx10_43.dll
<SYSTEM32>\d3dx10_42.dll
<SYSTEM32>\d3dx10_41.dll
<SYSTEM32>\d3dx10_40.dll
<SYSTEM32>\d3dx10_39.dll
<SYSTEM32>\d3dx10_38.dll
<SYSTEM32>\d3dx10_37.dll
<SYSTEM32>\d3dx10_36.dll
<SYSTEM32>\d3dx10_35.dll
<SYSTEM32>\d3dx10_34.dll
<SYSTEM32>\d3dx10_33.dll
<SYSTEM32>\d3dx10.dll
<SYSTEM32>\d3dcsx_43.dll
<SYSTEM32>\d3dcompiler_43.dll
<SYSTEM32>\winevt\logs\microsoft-windows-windowssystemassessmenttool%4operational.evtx
<SYSTEM32>\localgroupadminadd.log
<SYSTEM32>\mfc100chs.dll
<SYSTEM32>\mfcm140.dll
<SYSTEM32>\mfcm120.dll
<SYSTEM32>\mfcm110u.dll
<SYSTEM32>\mfcm110.dll
<SYSTEM32>\mfcm100u.dll
<SYSTEM32>\mfcm100.dll
<SYSTEM32>\d3dx9_40.dll
<SYSTEM32>\mfc140u.dll
<SYSTEM32>\mfc140rus.dll
<SYSTEM32>\mfc140jpn.dll
<SYSTEM32>\mfc140ita.dll
<SYSTEM32>\mfc140fra.dll
<SYSTEM32>\mfc140esn.dll
<SYSTEM32>\mfc140enu.dll
<SYSTEM32>\mfcm120u.dll
<SYSTEM32>\mfcm140u.dll
<SYSTEM32>\msvcp90d.dll
<SYSTEM32>\mfc140cht.dll
<SYSTEM32>\migwiz.lnk
<SYSTEM32>\msvcp140d.dll
<SYSTEM32>\msvcp140.dll
<SYSTEM32>\msvcp120_clr0400.dll
<SYSTEM32>\msvcp120d.dll
<SYSTEM32>\msvcp120.dll
<SYSTEM32>\msvcp110_clr0400.dll
<SYSTEM32>\msvcp110d.dll
<SYSTEM32>\msvcp110.dll
<SYSTEM32>\msvcp100d.dll
<SYSTEM32>\msvcp100.dll
<SYSTEM32>\msvcm90d.dll
<SYSTEM32>\msflxgrd.ocx
<SYSTEM32>\msclmd.dll
<SYSTEM32>\mpsigstub.exe
<SYSTEM32>\mfc140deu.dll
<SYSTEM32>\mfc140kor.dll
<SYSTEM32>\mfc140chs.dll
<SYSTEM32>\mfc140.dll
<SYSTEM32>\local_llu.log
<SYSTEM32>\mfc100jpn.dll
<SYSTEM32>\mfc110cht.dll
<SYSTEM32>\mfc110chs.dll
<SYSTEM32>\mfc110.dll
<SYSTEM32>\mfc100u.dll
<SYSTEM32>\mfc100rus.dll
<SYSTEM32>\mfc100kor.dll
<SYSTEM32>\mfc100ita.dll
<SYSTEM32>\mfc110enu.dll
<SYSTEM32>\mfc100fra.dll
<SYSTEM32>\mfc100esn.dll
<SYSTEM32>\mfc100enu.dll
<SYSTEM32>\mfc100deu.dll
<SYSTEM32>\mfc100cht.dll
<SYSTEM32>\mfc110esn.dll
<SYSTEM32>\mfc100.dll
<SYSTEM32>\mfc110ita.dll
<SYSTEM32>\mfc110kor.dll
<SYSTEM32>\mfc120u.dll
<SYSTEM32>\mfc110deu.dll
<SYSTEM32>\mfc120rus.dll
<SYSTEM32>\mfc120kor.dll
<SYSTEM32>\mfc120jpn.dll
<SYSTEM32>\mfc120ita.dll
<SYSTEM32>\mfc120fra.dll
<SYSTEM32>\mfc120esn.dll
<SYSTEM32>\mfc120enu.dll
<SYSTEM32>\mfc120deu.dll
<SYSTEM32>\mfc120cht.dll
<SYSTEM32>\mfc120chs.dll
<SYSTEM32>\mfc120.dll
<SYSTEM32>\mfc110u.dll
<SYSTEM32>\mfc110rus.dll
<SYSTEM32>\mfc110jpn.dll
<SYSTEM32>\winevt\logs\microsoft-windows-restartmanager%4operational.evtx
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnge001.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prngt004.cat
<SYSTEM32>\logfiles\scm\0ea27ae9-c89e-4915-a50e-22689d11f757
<SYSTEM32>\logfiles\scm\0df6bf01-0d3d-414e-9ee8-f867ae8a63ca
<SYSTEM32>\logfiles\scm\09f06bfe-a3c8-40e3-846a-6e6f4000c238
<SYSTEM32>\logfiles\scm\088482fa-65b8-4e17-9abf-1dcd48e8d373
<SYSTEM32>\logfiles\scm\044a6734-e90e-4f8f-b357-b2dc8ab3b5ec
<SYSTEM32>\logfiles\ait\aiteventlog.etl.005
<SYSTEM32>\logfiles\scm\486d715e-6aa2-44cf-bc48-b6990cbb53c6
<SYSTEM32>\logfiles\ait\aiteventlog.etl.004
<SYSTEM32>\logfiles\ait\aiteventlog.etl.003
<SYSTEM32>\logfiles\ait\aiteventlog.etl.001
<SYSTEM32>\ias\dnary.xsd
<SYSTEM32>\grouppolicy\user\registry.pol
<SYSTEM32>\grouppolicy\machine\registry.pol
<SYSTEM32>\grouppolicy\gpt.ini
<SYSTEM32>\logfiles\scm\0e776036-0fd4-4b73-81b1-d33e42d09465
<SYSTEM32>\logfiles\scm\14c536b3-d9c4-4d0c-9543-a84e8a4dd41d
<SYSTEM32>\logfiles\scm\473c6571-3f6a-4d37-bf69-6b69cf0e6341
<DRIVERS>\etc\services
<SYSTEM32>\logfiles\scm\1588a3a7-6e8c-4d36-8e43-e5484fcecb6a
<SYSTEM32>\logfiles\scm\467b50ab-333d-4446-8e44-03c36d156e6a
<SYSTEM32>\logfiles\scm\3ed4dc29-6535-4ba6-8fdf-20bc50cb4900
<SYSTEM32>\logfiles\scm\39da18f9-f47b-424c-a519-ef112e2cb278
<SYSTEM32>\logfiles\scm\3437021b-71b0-42e6-97b6-0e845ad75d5c
<SYSTEM32>\logfiles\scm\2f57269b-1e09-4e2d-ab1e-b0fdac7d279c
<SYSTEM32>\logfiles\scm\2ab8fc9a-7ca1-4a2b-b24b-41f69369c2c2
<SYSTEM32>\logfiles\scm\28011108-68df-4c73-b91b-57427d501bba
<SYSTEM32>\logfiles\scm\24e77d77-b188-4b6e-a06a-7b564e41513e
<SYSTEM32>\logfiles\scm\2470470f-2634-478e-b181-571e98a789bb
<SYSTEM32>\logfiles\scm\23029558-6c9f-41af-ae41-721b1e0b01cf
<SYSTEM32>\logfiles\scm\1f7b7221-ae8f-44f3-ba82-f7d260f51964
<SYSTEM32>\logfiles\scm\1c37d1c4-1c40-4ef4-a242-6e599743c21d
<SYSTEM32>\logfiles\scm\19b5b15c-7a03-4b58-ba3d-8591f7561971
<SYSTEM32>\logfiles\scm\174730de-0de2-4b29-8596-e53aab11668b
<SYSTEM32>\en-us\dfshim.dll.mui
<SYSTEM32>\x3daudio1_0.dll
<SYSTEM32>\logfiles\ait\aiteventlog.etl.002
<DRIVERS>\etc\protocol
<DRIVERS>\usbcir.sys
<DRIVERS>\swenum.sys
<DRIVERS>\uagp35.sys
<DRIVERS>\tsusbhub.sys
<DRIVERS>\tsusbgd.sys
<DRIVERS>\terminpt.sys
<DRIVERS>\usbehci.sys
<DRIVERS>\synth3dvsc.sys
<DRIVERS>\stexstor.sys
<DRIVERS>\usbccgp.sys
<DRIVERS>\sisraid4.sys
<DRIVERS>\sisraid2.sys
<DRIVERS>\sfloppy.sys
<DRIVERS>\sffp_sd.sys
<DRIVERS>\umpass.sys
<DRIVERS>\etc\hosts
<DRIVERS>\etc\networks
<DRIVERS>\usbprint.sys
<DRIVERS>\etc\lmhosts.sam
<DRIVERS>\uliagpkx.sys
<DRIVERS>\wmiacpi.sys
<DRIVERS>\winhv.sys
<DRIVERS>\wd.sys
<DRIVERS>\wacompen.sys
<DRIVERS>\vsmraid.sys
<DRIVERS>\vmstorfl.sys
<DRIVERS>\vms3cap.sys
<DRIVERS>\vmbushid.sys
<DRIVERS>\vmbus.sys
<DRIVERS>\viaide.sys
<DRIVERS>\vhdmp.sys
<DRIVERS>\usbuhci.sys
<DRIVERS>\usbstor.sys
<SYSTEM32>\logfiles\scm\47536d45-eeec-4bdc-8183-a4dc1f8da9e4
<SYSTEM32>\logfiles\scm\4baaa31e-fee3-4d10-afa9-2bf0770795d8
<SYSTEM32>\logfiles\scm\scm.evm
<SYSTEM32>\logfiles\scm\98013a8b-b66f-4660-9144-e869d4b0b916
<SYSTEM32>\logfiles\scm\scm.evm.3
<SYSTEM32>\logfiles\scm\febaf7e1-73e6-44e2-8766-a1b9f15ee6bb
<SYSTEM32>\logfiles\scm\fdd56c73-f0d5-41b6-b767-6effd7966428
<SYSTEM32>\logfiles\scm\fb3c354d-297a-4eb2-9b58-090f6361906b
<SYSTEM32>\logfiles\scm\fae02932-da36-4a99-8483-5e5f12da46da
<SYSTEM32>\logfiles\scm\fa2bc0a6-8d4b-458a-85c8-2b8c72487513
<SYSTEM32>\logfiles\scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7
<SYSTEM32>\logfiles\scm\scm.evm.1
<SYSTEM32>\logfiles\scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
<SYSTEM32>\logfiles\scm\e3163c33-301d-4730-a266-5518c5ed3967
<SYSTEM32>\logfiles\scm\e22a8667-f75b-4ba9-ba46-067ed4429de8
<SYSTEM32>\logfiles\scm\e079c31e-a506-4a98-9cc3-88dc16486af1
<SYSTEM32>\logfiles\scm\dd9f510c-95f4-499a-90c8-bac5bc372ff4
<SYSTEM32>\logfiles\scm\da41de71-8431-42fb-9db0-eb64a961dead
<SYSTEM32>\logfiles\scm\ed29c547-fb49-4328-988c-6ef532e08e66
<SYSTEM32>\logfiles\scm\scm.evm.4
<SYSTEM32>\macromed\flash\plugin.vch
<SYSTEM32>\logfiles\scm\d0250f3f-6480-484f-b719-42f659ac64d5
<SYSTEM32>\migwiz\replacementmanifests\microsoft-windows-gameuxmig\gameuxmig.dll
<SYSTEM32>\macromed\flash\npswf64_18_0_0_261.dll
<SYSTEM32>\macromed\flash\flashutil64_19_0_0_207_activex.exe
<SYSTEM32>\macromed\flash\flashutil64_19_0_0_207_activex.dll
<SYSTEM32>\macromed\flash\flashutil64_18_0_0_261_plugin.exe
<SYSTEM32>\macromed\flash\flashinstall.log
<SYSTEM32>\macromed\flash\flash64_19_0_0_207.ocx
<SYSTEM32>\macromed\flash\activex.vch
<SYSTEM32>\logfiles\wudf\wudftrace.etl
<SYSTEM32>\logfiles\wmi\terminal-services-unified-apis.etl
<SYSTEM32>\logfiles\wmi\terminal-services-sessionenv.etl
<SYSTEM32>\logfiles\wmi\terminal-services-rpc-client.etl
<SYSTEM32>\logfiles\wmi\terminal-services-ip-virtualization.etl
<SYSTEM32>\logfiles\wmi\terminal-services-core.etl
<SYSTEM32>\logfiles\scm\d7b6e81d-3cf4-432c-84d2-24213f4316e6
<SYSTEM32>\logfiles\scm\eb02381f-d652-4b1c-894a-712498c62c51
<SYSTEM32>\logfiles\scm\scm.evm.2
<SYSTEM32>\logfiles\scm\cee64558-e1a7-4d9d-80a7-2001912be5b5
<SYSTEM32>\logfiles\scm\ce7b5023-2422-4f48-98c4-c2ed0a82c853
<SYSTEM32>\logfiles\scm\994c86ad-a929-4b2c-88a0-4e25a107a029
<SYSTEM32>\logfiles\scm\6738ba6e-ea75-4b6b-b8b8-71f0336dd8ef
<SYSTEM32>\logfiles\scm\8567ff9a-f89e-4168-9ae9-906241678a52
<SYSTEM32>\logfiles\scm\81540b9f-b5bf-47eb-9c95-be195bf2c664
<SYSTEM32>\logfiles\scm\7afcc0ca-7121-422a-ab45-b0e8d599ff08
<SYSTEM32>\logfiles\scm\753c47ae-ec5e-44b3-95a9-2c8e553f0e39
<SYSTEM32>\logfiles\scm\72db7465-bc54-491b-a92a-4637a28c9bbf
<SYSTEM32>\logfiles\scm\68170569-8b26-4a5b-a327-ace01f480666
<SYSTEM32>\logfiles\scm\632fde03-182b-4577-ac98-da357253a6dd
<DRIVERS>\sffdisk.sys
<SYSTEM32>\logfiles\scm\613612ba-897d-44ce-8dc1-8fc283f9fd51
<SYSTEM32>\logfiles\scm\5f5a18eb-dc73-4e45-a11c-b59043598412
<SYSTEM32>\logfiles\scm\5b42dd9c-5a26-4f27-bb95-34603f0997e5
<SYSTEM32>\logfiles\scm\5a40e926-9e86-4b89-9cfd-b12311724371
<SYSTEM32>\logfiles\scm\5033eff9-d2bc-41d0-be5c-ffbdf4ae0209
<SYSTEM32>\logfiles\scm\a0b729d9-5a98-4045-b5e4-c206c964830d
<DRIVERS>\sffp_mmc.sys
<SYSTEM32>\logfiles\scm\cb3d64bf-c0c9-45ff-bfb0-ff1a8f680186
<SYSTEM32>\logfiles\scm\a1d60d55-a6b8-401b-bc05-2938e02df2f2
<SYSTEM32>\logfiles\scm\9435f817-fed2-454e-88cd-7f78fda62c48
<SYSTEM32>\logfiles\scm\87dd7f5b-4b40-4b9a-9438-a855930477f7
<SYSTEM32>\logfiles\scm\ca4b8ff2-a4d2-4d88-a52e-3a5bdaf7f56e
<SYSTEM32>\logfiles\scm\c016366b-7126-46ca-b36b-592a3d95a60b
<SYSTEM32>\logfiles\scm\be669c13-8165-4536-96d0-6d6c39292aae
<SYSTEM32>\logfiles\scm\bdfe0823-197d-4cbe-be17-5ef8dc6071f2
<SYSTEM32>\logfiles\scm\b1751288-5acd-4b36-acff-e322459aebf5
<SYSTEM32>\logfiles\scm\b0cbab43-44fc-469b-a4ce-87426761fdce
<SYSTEM32>\logfiles\scm\ac668097-4d6b-4093-ac14-014c09dbf820
<SYSTEM32>\logfiles\scm\ac4e5acf-89f7-4220-ba21-81ee183975e2
<SYSTEM32>\logfiles\scm\a7c73732-9f11-4281-8d19-764d4ec9d94d
<SYSTEM32>\logfiles\scm\a6af9377-77ce-47ab-ad7d-ec32cad0c82d
<SYSTEM32>\logfiles\scm\a48cabbf-24c8-4b87-b00f-9261807c3b43
<SYSTEM32>\logfiles\scm\a35bb7a6-5f0c-4c9f-8450-2b3bed532d51
<SYSTEM32>\logfiles\scm\a258c8ba-f273-4a29-9223-3d4b504235c0
<SYSTEM32>\logfiles\scm\9979cb83-103a-4105-9e5d-c74b0af6d198
<DRIVERS>\storvsc.sys
<DRIVERS>\serial.sys
<DRIVERS>\serenum.sys
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnrc00b.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnod002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnrc005.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnrc004.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnrc003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnrc002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnrc00c.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnok002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnnr003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnrc00a.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnnr002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnms002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx00z.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx00y.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnrc007.cat
<SYSTEM32>\catroot2\edbres00002.jrs
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx00w.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnsa002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prngt002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx00e.cat
<SYSTEM32>\catroot2\edbres00001.jrs
<SYSTEM32>\catroot2\edb00563.log
<SYSTEM32>\catroot2\edb.chk
<SYSTEM32>\catroot2\dberr.txt
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\windows-legacy-whql.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnxx002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnts003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnts002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnsv004.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnsv003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnsv002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnso002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnsh002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx00x.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnnr004.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx00v.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx00d.cat
<SYSTEM32>\codeintegrity\bootcat.cache
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnin004.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnky003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnky002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnkm005.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnkm004.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnkm003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnkm002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnin003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnky005.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnin002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnhp005.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnhp004.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnhp003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnhp002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnky006.cat
<SYSTEM32>\config\bcd-template
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnky008.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnle002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnky007.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnky004.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx00c.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx00b.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx00a.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx009.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx008.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx007.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx006.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx005.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx004.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnlx002.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnle004.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnle003.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnky009.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prngt003.cat
<SYSTEM32>\config\system.dw_backup
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\portable devices\wpdlog00.sqm
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\prnrc006.cat
<DRIVERS>\megasas.sys
<DRIVERS>\lsi_sas2.sys
<DRIVERS>\lsi_sas.sys
<DRIVERS>\lsi_fc.sys
<DRIVERS>\kbdhid.sys
<DRIVERS>\megasr.sys
<DRIVERS>\isapnp.sys
<DRIVERS>\lsi_scsi.sys
<DRIVERS>\intelide.sys
<DRIVERS>\iastorv.sys
<DRIVERS>\hpsamd.sys
<DRIVERS>\hidir.sys
<DRIVERS>\hidbth.sys
<DRIVERS>\ipmidrv.sys
<DRIVERS>\sbp2port.sys
<DRIVERS>\gagp30kx.sys
<DRIVERS>\msahci.sys
<DRIVERS>\secdrv.sys
<DRIVERS>\mpio.sys
<DRIVERS>\ql40xx.sys
<DRIVERS>\ql2300.sys
<DRIVERS>\processr.sys
<DRIVERS>\pcmcia.sys
<DRIVERS>\pciide.sys
<DRIVERS>\ohci1394.sys
<DRIVERS>\nv_agp.sys
<DRIVERS>\nvstor.sys
<DRIVERS>\nvraid.sys
<DRIVERS>\nfrd960.sys
<DRIVERS>\mtconfig.sys
<DRIVERS>\msiscsi.sys
<DRIVERS>\msdsm.sys
<DRIVERS>\hidbatt.sys
<DRIVERS>\hcw85cir.sys
<DRIVERS>\iirsp.sys
<DRIVERS>\evbda.sys
<DRIVERS>\arc.sys
<SYSTEM32>\config\components
<DRIVERS>\adpu320.sys
<DRIVERS>\amdsata.sys
<DRIVERS>\amdppm.sys
<DRIVERS>\amdk8.sys
<DRIVERS>\amdide.sys
<DRIVERS>\aliide.sys
<DRIVERS>\agp440.sys
<DRIVERS>\adpahci.sys
<DRIVERS>\amdxata.sys
<DRIVERS>\adp94xx.sys
<DRIVERS>\acpipmi.sys
<DRIVERS>\1394ohci.sys
<DRIVERS>\1394bus.sys
<DRIVERS>\b57nd60a.sys
<SYSTEM32>\config\systemprofile\ntuser.dat
<DRIVERS>\blbdrive.sys
<DRIVERS>\brfiltup.sys
<DRIVERS>\errdev.sys
<DRIVERS>\elxstor.sys
<DRIVERS>\amdsbs.sys
<DRIVERS>\e1g6032e.sys
<DRIVERS>\dmvsc.sys
<DRIVERS>\crcdisk.sys
<DRIVERS>\compbatt.sys
<DRIVERS>\cmdide.sys
<DRIVERS>\circlass.sys
<DRIVERS>\bxvbda.sys
<DRIVERS>\bthmodem.sys
<DRIVERS>\brusbser.sys
<DRIVERS>\brusbmdm.sys
<DRIVERS>\brserwdm.sys
<DRIVERS>\brserid.sys
<DRIVERS>\brfiltlo.sys
<SYSTEM32>\winevt\logs\setup.evtx

Другое

Создает и запускает на исполнение

'<SYSTEM32>\wscript.exe' "<Текущая директория>\msgbox.vbs"
'<SYSTEM32>\cmd.exe' /c "%TEMP%\28F.tmp\290.tmp\291.bat <Полный путь к файлу>"' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "%TEMP%\28F.tmp\290.tmp\291.bat <Полный путь к файлу>"
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Application Experience\StartupAppTask" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /f
'<SYSTEM32>\schtasks.exe' /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /DISABLE
'<SYSTEM32>\schtasks.exe' /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /DISABLE
'<SYSTEM32>\schtasks.exe' /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /DISABLE
'<SYSTEM32>\schtasks.exe' /change /TN "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /DISABLE
'<SYSTEM32>\schtasks.exe' /change /TN "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /DISABLE
'<SYSTEM32>\bcdedit.exe' /set isolatedcontext No
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions" /v "PagePriority" /t REG_DWORD /d "5" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions" /v "IoPriority" /t REG_DWORD /d "2" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
'<SYSTEM32>\bcdedit.exe' /set tscsyncpolicy legacy
'<SYSTEM32>\bcdedit.exe' /set usefirmwarepcisettings No
'<SYSTEM32>\bcdedit.exe' /set MSI Default
'<SYSTEM32>\bcdedit.exe' /set configaccesspolicy Default
'<SYSTEM32>\bcdedit.exe' /set vm No
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
'<SYSTEM32>\bcdedit.exe' /set vsmlaunchtype Off
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Clip\License Validation" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Printing\EduPrintProv" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Maintenance\WinSAT" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\DiskFootprint\StorageSense" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\BrokerInfrastructure\BgTaskRegistrationMaintenanceTask" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\HelloFace\FODCleanupTask" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Maps\MapsUpdateTask" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Maps\MapsToastTask" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
'<SYSTEM32>\bcdedit.exe' /set quietboot yes
'<SYSTEM32>\bcdedit.exe' /set tpmbootentropy ForceDisable
'<SYSTEM32>\bcdedit.exe' /set hypervisorlaunchtype off
'<SYSTEM32>\netsh.exe' int tcp set global autotuninglevel=normal chimney=disabled congestionprovider=ctcp netdma=disabled
'<SYSTEM32>\netsh.exe' int ip set global sourceroutingbehavior=drop
'<SYSTEM32>\netsh.exe' int ip set global routecachelimit=4096
'<SYSTEM32>\netsh.exe' int ip set global neighborcachelimit=4096
'<SYSTEM32>\netsh.exe' int udp set global uro=enabled
'<SYSTEM32>\netsh.exe' int tcp set global autotuninglevel=disabled
'<SYSTEM32>\netsh.exe' winsock set autotuning on
'<SYSTEM32>\netsh.exe' int isatap set state disable
'<SYSTEM32>\sc.exe' config clfs start=disabled
'<SYSTEM32>\sc.exe' config cdpusersvc start=disabled
'<SYSTEM32>\sc.exe' config cdpsvc start=disabled
'<SYSTEM32>\sc.exe' config sens start=disabled
'<SYSTEM32>\sc.exe' config mpssvc start=disabled
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp" /v "DependOnService" /t REG_MULTI_SZ /d "NSI\0Afd" /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}" /v "UpperFilters" /t REG_MULTI_SZ /d "" /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}" /v "LowerFilters" /t REG_MULTI_SZ /d "" /f
'<SYSTEM32>\timeout.exe' /T 0 /NOBREAK
'<SYSTEM32>\sc.exe' config bfe start=disabled
'<SYSTEM32>\cmd.exe' /c netsh int ip show interfaces | findstr [0-9]
'<SYSTEM32>\netsh.exe' interface teredo set state disabled
'<SYSTEM32>\netsh.exe' int ip show interfaces
'<SYSTEM32>\bcdedit.exe' /set bootmenupolicy standard
'<SYSTEM32>\powercfg.exe' -delete 381b4222-f694-41f0-9685-ff5bb260df2e
'<SYSTEM32>\bcdedit.exe' /set bootux disabled
'<SYSTEM32>\bcdedit.exe' /set nx optout
'<SYSTEM32>\bcdedit.exe' /timeout 5
'<SYSTEM32>\bcdedit.exe' /set useplatformtick yes
'<SYSTEM32>\bcdedit.exe' /set disabledynamictick yes
'<SYSTEM32>\bcdedit.exe' /deletevalue useplatformclock
'<SYSTEM32>\powercfg.exe' -delete a1841308-3541-4fab-bc81-f71556f20b4a
'<SYSTEM32>\powercfg.exe' -delete 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
'<SYSTEM32>\powercfg.exe' /s 7ccf8e2a-7e59-4fb8-b4dd-eace331dc1b9
'<SYSTEM32>\findstr.exe' [0-9]
'<SYSTEM32>\powercfg.exe' -import "%WINDIR%\powerplan.pow" 7ccf8e2a-7e59-4fb8-b4dd-eace331dc1b9
'<SYSTEM32>\netsh.exe' int ipv4 set dynamicport udp start=1025 num=64511
'<SYSTEM32>\netsh.exe' int ipv4 set dynamicport tcp start=1025 num=64511
'<SYSTEM32>\netsh.exe' int tcp set security profiles=disabled
'<SYSTEM32>\netsh.exe' int tcp set security mpp=disabled
'<SYSTEM32>\netsh.exe' int tcp set heuristics wsh=disabled
'<SYSTEM32>\netsh.exe' int tcp set heuristics disabled
'<SYSTEM32>\netsh.exe' int ip set interface 11 basereachable=3600000 dadtransmits=0 otherstateful=disabled routerdiscovery=disabled store=persistent
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Servicing\StartComponentCleanup" /f
'<SYSTEM32>\schtasks.exe' /delete /TN "\Microsoft\Windows\Setup\SetupCleanupTask" /f

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней