Trojan.Siggen9.11956

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\UCORESYS] 'ImagePath' = '%APPDATA%\UCORESYS.sys'
[<HKLM>\System\CurrentControlSet\Services\UCOREW64] 'ImagePath' = '%APPDATA%\UCOREW64.sys'

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /IM "EpicGamesLauncher.exe" /T /F
'<SYSTEM32>\taskkill.exe' /IM "FortniteClient-Win64-Shipping.exe" /T /F
'<SYSTEM32>\taskkill.exe' /IM "FortniteClient-Win64-Shipping_EAC.exe" /T /F
'<SYSTEM32>\taskkill.exe' /IM "FortniteLauncher.exe" /T /F
'<SYSTEM32>\taskkill.exe' /f /im Cleaner2.exe
'<SYSTEM32>\taskkill.exe' /f /im Cleaner4.exe
'<SYSTEM32>\taskkill.exe' /f /im Cleaner7.exe
'<SYSTEM32>\taskkill.exe' /f /im Cleaner1.exe
'<SYSTEM32>\taskkill.exe' /f /im Cleaner8.exe

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Modifies file system

Creates the following files

%TEMP%\46bf.tmp\46d0.tmp\46d1.bat
%TEMP%\protect4a647d98.dll
%WINDIR%\temp\uddb22b.tmp
%WINDIR%\syswow64\drivers\ucoresys.sys
nul
%APPDATA%\volumeid64.exe
%APPDATA%\ucorew64.sys
%APPDATA%\ucorevxd.vxd
%APPDATA%\ucoresys.sys
%APPDATA%\ucoredll.dll
%APPDATA%\starter.bat
%APPDATA%\runapple.bat
%APPDATA%\reset_adapters.exe
%APPDATA%\no-rundevcon.exe
%APPDATA%\cleanerold1.exe
%APPDATA%\cleanera.exe
%APPDATA%\cleaner8.exe
%APPDATA%\cleaner7.exe
%APPDATA%\cleaner4.exe
%APPDATA%\cleaner2.exe
%APPDATA%\amidewin.exe
%APPDATA%\aextract.exe
%APPDATA%\3combined.bat
%APPDATA%\1-runfirst.exe
\device\harddiskvolume2
%WINDIR%\temp\fwtsqmfile00.sqm

Deletes the following files

%TEMP%\46bf.tmp\46d0.tmp\46d1.bat
%WINDIR%\inf\ph3xibc3.pnf
%WINDIR%\inf\ph3xibc7.inf
%WINDIR%\inf\ph3xibc6.pnf
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\desktop.ini
%WINDIR%\inf\ph3xibc6.inf
%WINDIR%\inf\ph3xibc5.pnf
%WINDIR%\inf\ph3xibc5.inf
%WINDIR%\inf\ph3xibc4.pnf
%WINDIR%\inf\ph3xibc4.inf
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\desktop.ini
%WINDIR%\inf\ph3xibc3.inf
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\index.dat
%WINDIR%\inf\ph3xibc2.pnf
%WINDIR%\inf\ph3xibc2.inf
%WINDIR%\inf\ph3xibc12.pnf
%WINDIR%\inf\ph3xibc12.inf
%WINDIR%\inf\ph3xibc11.pnf
%WINDIR%\inf\ph3xibc11.inf
%WINDIR%\inf\ph3xibc10.pnf
%WINDIR%\inf\oem1.inf
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\desktop.ini
%WINDIR%\inf\prnbr004.inf
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\lixmvqoa\desktop.ini
%WINDIR%\logs\cbs\cbs.log
%WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\crypto\rsa\s-1-5-19\7e22207fe9846926e18c29d3e675240e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%WINDIR%\inf\prnbr003.pnf
%WINDIR%\inf\prnbr003.inf
%WINDIR%\inf\prnbr002.pnf
%WINDIR%\inf\prnbr002.inf
%WINDIR%\inf\ph6xib64c1.pnf
%WINDIR%\inf\ph6xib64c1.inf
%WINDIR%\inf\ph6xib64c0.pnf
%WINDIR%\inf\ph3xibc10.inf
%WINDIR%\inf\ph3xibc1.pnf
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\62axopq5\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0ps72r2m\desktop.ini
%WINDIR%\inf\ph6xib64c0.inf
%WINDIR%\inf\ph3xibc9.pnf
%WINDIR%\inf\ph3xibc9.inf
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\index.dat
%WINDIR%\inf\ph3xibc8.pnf
%WINDIR%\inf\ph3xibc8.inf
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\fzg8ckj5\desktop.ini
%WINDIR%\inf\ph3xibc7.pnf
%WINDIR%\inf\ph3xibc1.inf
%WINDIR%\inf\ph3xibc0.pnf
%WINDIR%\inf\prnbr004.pnf
%WINDIR%\inf\nettun.pnf
%WINDIR%\inf\netxex64.inf
%WINDIR%\inf\netw5v64.pnf
%WINDIR%\inf\netw5v64.inf
%WINDIR%\inf\netvwifibus.pnf
%WINDIR%\inf\netvwifibus.inf
%WINDIR%\inf\netvg62a.pnf
%WINDIR%\inf\netvg62a.inf
%WINDIR%\inf\netxfx64.pnf
%WINDIR%\inf\netvfx64.pnf
%WINDIR%\inf\netvfx64.inf
%WINDIR%\inf\nettun.inf
%WINDIR%\inf\nettcpip.pnf
%WINDIR%\inf\netsstpt.pnf
%WINDIR%\inf\netsstpa.pnf
%WINDIR%\inf\netserv.pnf
%WINDIR%\inf\netrtx64.pnf
%WINDIR%\inf\netrtx64.inf
%WINDIR%\inf\netrtl64.pnf
%WINDIR%\inf\netxfx64.inf
%WINDIR%\inf\netrndis.pnf
%WINDIR%\inf\nfrd960.pnf
%WINDIR%\inf\ntprint.pnf
%WINDIR%\inf\ph3xibc0.inf
%WINDIR%\inf\nfrd960.inf
%WINDIR%\inf\perflib\0409\perfi.dat
%WINDIR%\inf\perflib\0409\perfh.dat
%WINDIR%\inf\perflib\0409\perfd.dat
%WINDIR%\inf\perflib\0409\perfc.dat
%WINDIR%\inf\perflib\0000\perfi.dat
%WINDIR%\inf\perflib\0000\perfh.dat
%WINDIR%\inf\perflib\0000\perfd.dat
%WINDIR%\inf\ntprint.inf
%WINDIR%\inf\perflib\0000\perfc.dat
%WINDIR%\inf\pcmcia.inf
%WINDIR%\inf\netxex64.pnf
%WINDIR%\inf\oem0.inf
%WINDIR%\inf\nv_lh.pnf
%WINDIR%\inf\nv_lh.inf
%WINDIR%\inf\nvraid.pnf
%WINDIR%\inf\nvraid.inf
%WINDIR%\inf\nulhpopr.pnf
%WINDIR%\inf\nulhpopr.inf
%WINDIR%\inf\pcmcia.pnf
%WINDIR%\inf\netrtl64.inf
%WINDIR%\inf\prnbr005.inf
%WINDIR%\inf\prnca003.inf
%WINDIR%\inf\prngt003.pnf
%WINDIR%\inf\prngt003.inf
%WINDIR%\inf\prngt002.pnf
%WINDIR%\inf\prngt002.inf
%WINDIR%\inf\prnge001.pnf
%WINDIR%\inf\prnge001.inf
%WINDIR%\inf\prnfx002.pnf
%WINDIR%\inf\prnfx002.inf
%WINDIR%\inf\prnep00l.pnf
%WINDIR%\inf\prnep00g.pnf
%WINDIR%\inf\prngt004.pnf
%WINDIR%\inf\prnep00g.inf
%WINDIR%\inf\prnep00f.pnf
%WINDIR%\inf\prnep00f.inf
%WINDIR%\inf\prnep00e.pnf
%WINDIR%\inf\prnep00e.inf
%WINDIR%\inf\prnep00d.pnf
%WINDIR%\inf\prnep00d.inf
%WINDIR%\inf\prnep00c.pnf
%WINDIR%\inf\prnep00l.inf
%WINDIR%\inf\prnep00b.inf
%WINDIR%\inf\prnhp002.inf
%WINDIR%\inf\prnkm005.pnf
%WINDIR%\inf\prnkm005.inf
%WINDIR%\inf\prnkm004.pnf
%WINDIR%\inf\prnkm004.inf
%WINDIR%\inf\prnkm003.pnf
%WINDIR%\inf\prnkm003.inf
%WINDIR%\inf\prnkm002.pnf
%WINDIR%\inf\prnkm002.inf
%WINDIR%\inf\prnin004.pnf
%WINDIR%\inf\prnep00c.inf
%WINDIR%\inf\prngt004.inf
%WINDIR%\inf\prnin003.inf
%WINDIR%\inf\prnin002.pnf
%WINDIR%\inf\prnin002.inf
%WINDIR%\inf\prnhp005.pnf
%WINDIR%\inf\prnhp005.inf
%WINDIR%\inf\prnhp004.pnf
%WINDIR%\inf\prnhp004.inf
%WINDIR%\inf\prnhp003.pnf
%WINDIR%\inf\prnhp003.inf
%WINDIR%\inf\prnin003.pnf
%WINDIR%\inf\prnhp002.pnf
%WINDIR%\inf\prnep00b.pnf
%WINDIR%\inf\prnep00a.pnf
%WINDIR%\inf\net8187bv64.inf
%WINDIR%\inf\prnca003.pnf
%WINDIR%\inf\prnca00d.pnf
%WINDIR%\inf\prnca00d.inf
%WINDIR%\inf\prnca00c.pnf
%WINDIR%\inf\prnca00c.inf
%WINDIR%\inf\prnca00b.pnf
%WINDIR%\inf\prnca00b.inf
%WINDIR%\inf\prnca00a.pnf
%WINDIR%\inf\prnca00a.inf
%WINDIR%\inf\prnca00e.inf
%WINDIR%\inf\prnca00e.pnf
%WINDIR%\inf\prnbr005.pnf
%WINDIR%\inf\prnbr00a.inf
%WINDIR%\inf\prnbr009.pnf
%WINDIR%\inf\prnbr009.inf
%WINDIR%\inf\prnbr008.pnf
%WINDIR%\inf\prnbr008.inf
%WINDIR%\inf\prnbr007.pnf
%WINDIR%\inf\prnbr007.inf
%WINDIR%\inf\prnbr006.pnf
%WINDIR%\inf\prnbr00a.pnf
%WINDIR%\inf\prnbr006.inf
%WINDIR%\inf\prnca00f.inf
%WINDIR%\inf\prnca00z.inf
%WINDIR%\inf\prnca00z.pnf
%WINDIR%\inf\prnep005.pnf
%WINDIR%\inf\prnep005.inf
%WINDIR%\inf\prnep004.pnf
%WINDIR%\inf\prnep004.inf
%WINDIR%\inf\prnep003.pnf
%WINDIR%\inf\prnep003.inf
%WINDIR%\inf\prnep002.pnf
%WINDIR%\inf\prnep002.inf
%WINDIR%\inf\prnep00a.inf
%WINDIR%\inf\prnca00f.pnf
%WINDIR%\inf\prnca00g.inf
%WINDIR%\inf\prnca00y.inf
%WINDIR%\inf\prnca00x.pnf
%WINDIR%\inf\prnca00x.inf
%WINDIR%\inf\prnca00i.pnf
%WINDIR%\inf\prnca00i.inf
%WINDIR%\inf\prnca00h.pnf
%WINDIR%\inf\prnca00h.inf
%WINDIR%\inf\prnca00g.pnf
%WINDIR%\inf\prnca00y.pnf
%WINDIR%\inf\netrndis.inf
%WINDIR%\inf\netrast.pnf
%WINDIR%\inf\netrass.pnf
%WINDIR%\inf\modemcsa.pnf
%WINDIR%\inf\modemcsa.inf
%WINDIR%\inf\mf.pnf
%WINDIR%\inf\mf.inf
%WINDIR%\inf\memory.pnf
%WINDIR%\inf\memory.inf
%WINDIR%\inf\megasr.pnf
%WINDIR%\inf\megasr.inf
%WINDIR%\inf\megasas2.pnf
%WINDIR%\inf\megasas.pnf
%WINDIR%\inf\mpio.pnf
%WINDIR%\inf\megasas.inf
%WINDIR%\inf\mdmzyxlg.pnf
%WINDIR%\inf\mdmzyxlg.inf
%WINDIR%\inf\mdmzyxel.pnf
%WINDIR%\inf\mdmzyxel.inf
%WINDIR%\inf\mdmzyp.pnf
%WINDIR%\inf\mdmzyp.inf
%WINDIR%\inf\monitor.pnf
%WINDIR%\inf\megasas2.inf
%WINDIR%\inf\msdtc bridge 4.0.0.0\0014\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msclmd.inf
%WINDIR%\inf\msdtc bridge 4.0.0.0\0011\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\0010\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\000e\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\000d\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\000c\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\000b\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\000a\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\0009\_transactionbridgeperfcounters.ini
%WINDIR%\inf\mdmzoom.pnf
%WINDIR%\inf\msdtc bridge 4.0.0.0\0008\_transactionbridgeperfcounters.ini
%WINDIR%\inf\mpio.inf
%WINDIR%\inf\msdtc bridge 4.0.0.0\0005\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\0001\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 3.0.0.0\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 3.0.0.0\_transactionbridgeperfcounters.h
%WINDIR%\inf\msdsm.pnf
%WINDIR%\inf\msdsm.inf
%WINDIR%\inf\msdri.inf
%WINDIR%\inf\msclmd.pnf
%WINDIR%\inf\msdtc bridge 4.0.0.0\0007\_transactionbridgeperfcounters.ini
%WINDIR%\inf\mdmzoom.inf
%WINDIR%\inf\msdtc bridge 4.0.0.0\0012\_transactionbridgeperfcounters.ini
%WINDIR%\inf\mdmx5560.pnf
%WINDIR%\inf\mdmx5560.inf
%WINDIR%\inf\mdmtdkj7.pnf
%WINDIR%\inf\msdtc bridge 4.0.0.0\0013\_transactionbridgeperfcounters.ini
%WINDIR%\inf\mdmtdkj6.pnf
%WINDIR%\inf\mdmtdkj6.inf
%WINDIR%\inf\mdmtdkj5.pnf
%WINDIR%\inf\mdmtdkj5.inf
%WINDIR%\inf\mdmtdkj4.pnf
%WINDIR%\inf\mdmtdkj4.inf
%WINDIR%\inf\mdmtdkj3.pnf
%WINDIR%\inf\mdmtexas.inf
%WINDIR%\inf\mdmtexas.pnf
%WINDIR%\inf\mdmtdkj3.inf
%WINDIR%\inf\mdmtdk.pnf
%WINDIR%\inf\mdmtdk.inf
%WINDIR%\inf\mdmsuprv.pnf
%WINDIR%\inf\mdmsuprv.inf
%WINDIR%\inf\mdmsupra.pnf
%WINDIR%\inf\mdmsupra.inf
%WINDIR%\inf\mdmsupr3.pnf
%WINDIR%\inf\mdmsupr3.inf
%WINDIR%\inf\mdmtdkj2.pnf
%WINDIR%\inf\mdmtdkj2.inf
%WINDIR%\inf\msdtc bridge 4.0.0.0\0006\_transactionbridgeperfcounters.ini
%WINDIR%\inf\mdmti.pnf
%WINDIR%\inf\mdmusrgl.pnf
%WINDIR%\inf\mdmusrk1.inf
%WINDIR%\inf\mdmwhql0.inf
%WINDIR%\inf\mdmvv.pnf
%WINDIR%\inf\mdmvv.inf
%WINDIR%\inf\mdmvdot.pnf
%WINDIR%\inf\mdmvdot.inf
%WINDIR%\inf\mdmusrsp.pnf
%WINDIR%\inf\mdmusrsp.inf
%WINDIR%\inf\mdmusrk1.pnf
%WINDIR%\inf\mdmwhql0.pnf
%WINDIR%\inf\mdmti.inf
%WINDIR%\inf\mdmtdkj7.inf
%WINDIR%\inf\mdmusrg.pnf
%WINDIR%\inf\mdmusrg.inf
%WINDIR%\inf\mdmusrf.pnf
%WINDIR%\inf\mdmusrf.inf
%WINDIR%\inf\mdmtron.pnf
%WINDIR%\inf\mdmtron.inf
%WINDIR%\inf\mdmtkr.pnf
%WINDIR%\inf\mdmtkr.inf
%WINDIR%\inf\mdmusrgl.inf
%WINDIR%\inf\monitor.inf
%WINDIR%\inf\msdtc bridge 4.0.0.0\0015\_transactionbridgeperfcounters.ini
%WINDIR%\inf\netl160a.pnf
%WINDIR%\inf\netg664.pnf
%WINDIR%\inf\netl160a.inf
%WINDIR%\inf\netk57a.pnf
%WINDIR%\inf\netk57a.inf
%WINDIR%\inf\netirda.pnf
%WINDIR%\inf\netirda.inf
%WINDIR%\inf\netip6.pnf
%WINDIR%\inf\netimm.pnf
%WINDIR%\inf\netimm.inf
%WINDIR%\inf\msdtc bridge 4.0.0.0\0019\_transactionbridgeperfcounters.ini
%WINDIR%\inf\netl1c64.inf
%WINDIR%\inf\netbxnda.inf
%WINDIR%\inf\netevbda.inf
%WINDIR%\inf\netefe3e.pnf
%WINDIR%\inf\netefe3e.inf
%WINDIR%\inf\nete1g3e.pnf
%WINDIR%\inf\nete1g3e.inf
%WINDIR%\inf\nete1e3e.pnf
%WINDIR%\inf\nete1e3e.inf
%WINDIR%\inf\netbxnda.pnf
%WINDIR%\inf\netevbda.pnf
%WINDIR%\inf\netg664.inf
%WINDIR%\inf\netl1c64.pnf
%WINDIR%\inf\netnvm64.pnf
%WINDIR%\inf\netnvma.inf
%WINDIR%\inf\netr7364.inf
%WINDIR%\inf\netr28x.pnf
%WINDIR%\inf\netr28x.inf
%WINDIR%\inf\netr28ux.pnf
%WINDIR%\inf\netr28ux.inf
%WINDIR%\inf\netpacer.pnf
%WINDIR%\inf\netnwifi.pnf
%WINDIR%\inf\netnvma.pnf
%WINDIR%\inf\netr7364.pnf
%WINDIR%\inf\netl1e64.inf
%WINDIR%\inf\netl1e64.pnf
%WINDIR%\inf\netnb.pnf
%WINDIR%\inf\netmyk00.pnf
%WINDIR%\inf\netmyk00.inf
%WINDIR%\inf\netmscli.pnf
%WINDIR%\inf\netloop.pnf
%WINDIR%\inf\netloop.inf
%WINDIR%\inf\netl260a.pnf
%WINDIR%\inf\netl260a.inf
%WINDIR%\inf\netnvm64.inf
%WINDIR%\inf\prnin004.inf
%WINDIR%\inf\prnky002.inf
%WINDIR%\inf\netbc664.pnf
%WINDIR%\inf\mshdc.inf
%WINDIR%\inf\mtconfig.pnf
%WINDIR%\inf\mtconfig.inf
%WINDIR%\inf\mstape.pnf
%WINDIR%\inf\mstape.inf
%WINDIR%\inf\msports.pnf
%WINDIR%\inf\msports.inf
%WINDIR%\inf\msmouse.pnf
%WINDIR%\inf\msmouse.inf
%WINDIR%\inf\netbvbda.inf
%WINDIR%\inf\multiprt.pnf
%WINDIR%\inf\msdv.pnf
%WINDIR%\inf\msdv.inf
%WINDIR%\inf\msdtc bridge 4.0.0.0\_transactionbridgeperfcounters.h
%WINDIR%\inf\msdtc bridge 4.0.0.0\0816\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\0804\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\0416\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\0404\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\001f\_transactionbridgeperfcounters.ini
%WINDIR%\inf\msdtc bridge 4.0.0.0\001d\_transactionbridgeperfcounters.ini
%WINDIR%\inf\mshdc.pnf
%WINDIR%\inf\netbvbda.pnf
%WINDIR%\inf\ndiscap.pnf
%WINDIR%\inf\net1kx64.pnf
%WINDIR%\inf\ndisuio.pnf
%WINDIR%\inf\netbc664.inf
%WINDIR%\inf\netb57va.pnf
%WINDIR%\inf\netb57va.inf
%WINDIR%\inf\netavpnt.pnf
%WINDIR%\inf\netavpna.pnf
%WINDIR%\inf\netathrx.pnf
%WINDIR%\inf\netathrx.inf
%WINDIR%\inf\net8187se64.pnf
%WINDIR%\inf\net1kx64.inf
%WINDIR%\inf\net8187se64.inf
%WINDIR%\inf\multiprt.inf
%WINDIR%\inf\net8185.pnf
%WINDIR%\inf\net8185.inf
%WINDIR%\inf\net44amd.pnf
%WINDIR%\inf\net44amd.inf
%WINDIR%\inf\net1yx64.pnf
%WINDIR%\inf\net1yx64.inf
%WINDIR%\inf\net1qx64.pnf
%WINDIR%\inf\net1qx64.inf
%WINDIR%\inf\net8187bv64.pnf
%WINDIR%\inf\scsidev.pnf
%WINDIR%\syswow64\wdi\perftrack\themecpl.ptxml
%WINDIR%\inf\prnky003.pnf
%WINDIR%\inf\wiabr005.inf
%WINDIR%\inf\wiabr009.pnf
%WINDIR%\inf\wiabr009.inf
%WINDIR%\inf\wiabr008.pnf
%WINDIR%\inf\wiabr008.inf
%WINDIR%\inf\wiabr007.pnf
%WINDIR%\inf\wiabr007.inf
%WINDIR%\inf\wiabr006.pnf
%WINDIR%\inf\wiabr006.inf
%WINDIR%\inf\wiabr005.pnf
%WINDIR%\inf\wiabr004.pnf
%WINDIR%\inf\wiabr00a.pnf
%WINDIR%\inf\wiabr004.inf
%WINDIR%\inf\wiabr002.pnf
%WINDIR%\inf\wiabr002.inf
%WINDIR%\inf\wfplwf.pnf
%WINDIR%\inf\wdmvsc.inf
%WINDIR%\inf\wdma_usb.pnf
%WINDIR%\inf\wdma_usb.inf
%WINDIR%\inf\volsnap.inf
%WINDIR%\inf\wiaca00a.inf
%WINDIR%\inf\wiahp001.pnf
%WINDIR%\inf\wiaca00f.pnf
%WINDIR%\inf\wiaca00i.inf
%WINDIR%\inf\wiahp001.inf
%WINDIR%\inf\wiaep003.pnf
%WINDIR%\inf\wiaep003.inf
%WINDIR%\inf\wiaep002.pnf
%WINDIR%\inf\wiaep002.inf
%WINDIR%\inf\wiacn001.pnf
%WINDIR%\inf\wiacn001.inf
%WINDIR%\inf\wiaca00i.pnf
%WINDIR%\inf\wdmaudio.pnf
%WINDIR%\inf\wdmaudio.inf
%WINDIR%\inf\wiaca00a.pnf
%WINDIR%\inf\wiaca00e.pnf
%WINDIR%\inf\wiaca00e.inf
%WINDIR%\inf\wiaca00d.pnf
%WINDIR%\inf\wiaca00d.inf
%WINDIR%\inf\wiaca00c.pnf
%WINDIR%\inf\wiaca00c.inf
%WINDIR%\inf\wiaca00b.pnf
%WINDIR%\inf\wiaca00b.inf
%WINDIR%\inf\wiaca00f.inf
%WINDIR%\inf\wiabr00a.inf
%WINDIR%\inf\wd.pnf
%WINDIR%\inf\wd.inf
%WINDIR%\inf\wiaky002.inf
%WINDIR%\inf\ts_generic.inf
%WINDIR%\inf\unknown.pnf
%WINDIR%\inf\unknown.inf
%WINDIR%\inf\umpass.pnf
%WINDIR%\inf\umpass.inf
%WINDIR%\inf\umbus.pnf
%WINDIR%\inf\umbus.inf
%WINDIR%\inf\ts_wpdmtp.pnf
%WINDIR%\inf\usbcir.inf
%WINDIR%\inf\ts_wpdmtp.inf
%WINDIR%\inf\ts_generic.pnf
%WINDIR%\inf\tsusbhubfilter.pnf
%WINDIR%\inf\tsusbhubfilter.inf
%WINDIR%\inf\tsusbhub.inf
%WINDIR%\inf\tsprint.pnf
%WINDIR%\inf\tsprint.inf
%WINDIR%\inf\tsgenericusbdriver.inf
%WINDIR%\inf\transfercable.pnf
%WINDIR%\inf\transfercable.inf
%WINDIR%\inf\usb.pnf
%WINDIR%\inf\tpm.inf
%WINDIR%\inf\usbport.inf
%WINDIR%\inf\usbprint.inf
%WINDIR%\inf\wceisvista.pnf
%WINDIR%\inf\usbcir.pnf
%WINDIR%\inf\wceisvista.inf
%WINDIR%\inf\wave.pnf
%WINDIR%\inf\wave.inf
%WINDIR%\inf\v_mscdsc.pnf
%WINDIR%\inf\v_mscdsc.inf
%WINDIR%\inf\vsmraid.pnf
%WINDIR%\inf\vsmraid.inf
%WINDIR%\inf\usbport.pnf
%WINDIR%\inf\volume.pnf
%WINDIR%\inf\volsnap.pnf
%WINDIR%\inf\usb.inf
%WINDIR%\inf\vhdmp.pnf
%WINDIR%\inf\vhdmp.inf
%WINDIR%\inf\usbvideo.pnf
%WINDIR%\inf\usbvideo.inf
%WINDIR%\inf\usbstor.pnf
%WINDIR%\inf\usbstor.inf
%WINDIR%\inf\usbprint.pnf
%WINDIR%\inf\volume.inf
%WINDIR%\inf\tpm.pnf
%WINDIR%\inf\wiaky002.pnf
%WINDIR%\inf\wiasa002.pnf
%WINDIR%\inf\xcbdav.pnf
%WINDIR%\inf\xcbdav.inf
%WINDIR%\inf\wvmic.inf
%WINDIR%\inf\wvmbusvideo.inf
%WINDIR%\inf\wvmbushid.inf
%WINDIR%\inf\wvmbus.inf
%WINDIR%\inf\wudfusbcciddriver.pnf
%WINDIR%\inf\wudfusbcciddriver.inf
%WINDIR%\inf\wstorvsc.inf
%WINDIR%\inf\wsdscdrv.pnf
%WINDIR%\inf\xnacc.pnf
%WINDIR%\inf\wsdscdrv.inf
%WINDIR%\inf\wsdprint.pnf
%WINDIR%\inf\wsdprint.inf
%WINDIR%\inf\ws3cap.inf
%WINDIR%\inf\wpdmtphw.pnf
%WINDIR%\inf\wpdmtphw.inf
%WINDIR%\inf\wpdmtp.pnf
%WINDIR%\inf\wpdmtp.inf
%WINDIR%\inf\wstorflt.inf
%WINDIR%\inf\wpdcomp.pnf
%WINDIR%\logs\directx.log
%WINDIR%\syswow64\wdi\perftrack\taskmgr.events.ptxml
%WINDIR%\syswow64\wdi\perftrack\prod_wow64_wmpplayer.ptxml
%WINDIR%\syswow64\wdi\perftrack\prod_wow64_audio-audiocore.ptxml
%WINDIR%\syswow64\wdi\perftrack\powercpl.ptxml
%WINDIR%\syswow64\wdi\perftrack\networkdiagnosticsframework.ptxml
%WINDIR%\syswow64\wdi\perftrack\networkconnectionsfolder.ptxml
%WINDIR%\syswow64\wdi\perftrack\microsoft-windows-wlanconnectionflow.ptxml
%WINDIR%\syswow64\wdi\perftrack\help-datalayer.ptxml
%WINDIR%\syswow64\wdi\perftrack\healthcenterinstrumentation.ptxml
%WINDIR%\inf\wpdfs.pnf
%WINDIR%\inf\xnacc.inf
%WINDIR%\syswow64\wdi\perftrack\display.ptxml
%WINDIR%\syswow64\wdi\perftrack\diagcpl.events.ptxml
%WINDIR%\syswow64\wdi\perftrack\dhcpclientdll.ptxml
%WINDIR%\syswow64\wdi\perftrack\deviceux.ptxml
%WINDIR%\syswow64\wdi\perftrack\comdlg32.ptxml
%WINDIR%\syswow64\wdi\perftrack\authui.ptxml
%WINDIR%\syswow64\wdi\perftrack\alttab.ptxml
%WINDIR%\logs\homegroup\homegrouplog.etl
%WINDIR%\logs\dpx\setuperr.log
%WINDIR%\syswow64\wdi\perftrack\displayswitch.ptxml
%WINDIR%\logs\dpx\setupact.log
%WINDIR%\inf\wpdfs.inf
%WINDIR%\inf\wpdcomp.inf
%WINDIR%\inf\prnky002.pnf
%WINDIR%\inf\wiaxx002.inf
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0008\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0007\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0006\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0005\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0001\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 3.0.0.0\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 3.0.0.0\perfcounters.h
%WINDIR%\inf\wiaxx002.pnf
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0009\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\000a\perfcounters.ini
%WINDIR%\inf\wialx002.inf
%WINDIR%\inf\wialx006.pnf
%WINDIR%\inf\wialx006.inf
%WINDIR%\inf\wialx005.pnf
%WINDIR%\inf\wialx005.inf
%WINDIR%\inf\wialx004.pnf
%WINDIR%\inf\wialx004.inf
%WINDIR%\inf\wialx003.pnf
%WINDIR%\inf\wialx003.inf
%WINDIR%\inf\wiasa002.inf
%WINDIR%\inf\wialx002.pnf
%WINDIR%\inf\windows workflow foundation 4.0.0.0\000b\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\001f\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0404\perfcounters.ini
%WINDIR%\inf\winusb.pnf
%WINDIR%\inf\winusb.inf
%WINDIR%\inf\windowssideshowenhanceddriver.pnf
%WINDIR%\inf\windowssideshowenhanceddriver.inf
%WINDIR%\inf\windows workflow foundation 4.0.0.0\perfcounters.h
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0816\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0804\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0416\perfcounters.ini
%WINDIR%\inf\wnetvsc.inf
%WINDIR%\inf\windows workflow foundation 4.0.0.0\000c\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\000d\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0019\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0015\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0014\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0013\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0012\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0011\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\0010\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\000e\perfcounters.ini
%WINDIR%\inf\windows workflow foundation 4.0.0.0\001d\perfcounters.ini
%WINDIR%\inf\termmou.inf
%WINDIR%\inf\termkbd.inf
%WINDIR%\inf\tdibth.pnf
%WINDIR%\inf\prnok002.pnf
%WINDIR%\inf\prnok002.inf
%WINDIR%\inf\prnod002.pnf
%WINDIR%\inf\prnod002.inf
%WINDIR%\inf\prnnr004.pnf
%WINDIR%\inf\prnnr004.inf
%WINDIR%\inf\prnnr003.pnf
%WINDIR%\inf\prnnr003.inf
%WINDIR%\inf\prnnr002.pnf
%WINDIR%\inf\prnms002.pnf
%WINDIR%\inf\prnrc003.pnf
%WINDIR%\inf\prnms002.inf
%WINDIR%\inf\prnlx00z.pnf
%WINDIR%\inf\prnlx00z.inf
%WINDIR%\inf\prnlx00y.pnf
%WINDIR%\inf\prnlx00y.inf
%WINDIR%\inf\prnlx00x.pnf
%WINDIR%\inf\prnlx00x.inf
%WINDIR%\inf\prnrc002.pnf
%WINDIR%\inf\prnnr002.inf
%WINDIR%\inf\prnsv003.inf
%WINDIR%\inf\prnrc004.inf
%WINDIR%\inf\prnso002.pnf
%WINDIR%\inf\prnso002.inf
%WINDIR%\inf\prnsh002.pnf
%WINDIR%\inf\prnsh002.inf
%WINDIR%\inf\prnsa002.pnf
%WINDIR%\inf\prnsa002.inf
%WINDIR%\inf\prnrc00c.pnf
%WINDIR%\inf\prnrc00c.inf
%WINDIR%\inf\prnlx00w.pnf
%WINDIR%\inf\prnrc00b.pnf
%WINDIR%\inf\prnrc003.inf
%WINDIR%\inf\prnrc00a.inf
%WINDIR%\inf\prnrc007.pnf
%WINDIR%\inf\prnrc007.inf
%WINDIR%\inf\prnrc006.pnf
%WINDIR%\inf\prnrc006.inf
%WINDIR%\inf\prnrc005.pnf
%WINDIR%\inf\prnrc005.inf
%WINDIR%\inf\prnrc004.pnf
%WINDIR%\inf\prnrc00b.inf
%WINDIR%\inf\prnlx00w.inf
%WINDIR%\inf\prnsv002.inf
%WINDIR%\inf\prnlx00v.pnf
%WINDIR%\inf\prnlx00v.inf
%WINDIR%\inf\prnlx002.pnf
%WINDIR%\inf\prnsv002.pnf
%WINDIR%\inf\prnle004.pnf
%WINDIR%\inf\prnle004.inf
%WINDIR%\inf\prnle003.pnf
%WINDIR%\inf\prnle003.inf
%WINDIR%\inf\prnle002.pnf
%WINDIR%\inf\prnle002.inf
%WINDIR%\inf\prnky009.pnf
%WINDIR%\inf\prnlx003.inf
%WINDIR%\inf\prnlx003.pnf
%WINDIR%\inf\prnky009.inf
%WINDIR%\inf\prnky007.pnf
%WINDIR%\inf\prnky007.inf
%WINDIR%\inf\prnky006.pnf
%WINDIR%\inf\prnky006.inf
%WINDIR%\inf\prnky005.pnf
%WINDIR%\inf\prnky005.inf
%WINDIR%\inf\prnky004.pnf
%WINDIR%\inf\prnky004.inf
%WINDIR%\inf\prnky008.pnf
%WINDIR%\inf\prnky008.inf
%WINDIR%\inf\prnrc00a.pnf
%WINDIR%\inf\prnlx004.pnf
%WINDIR%\inf\prnlx009.pnf
%WINDIR%\inf\prnlx00a.inf
%WINDIR%\inf\prnlx00e.inf
%WINDIR%\inf\prnlx00d.pnf
%WINDIR%\inf\prnlx00d.inf
%WINDIR%\inf\prnlx00c.pnf
%WINDIR%\inf\prnlx00c.inf
%WINDIR%\inf\prnlx00b.pnf
%WINDIR%\inf\prnlx00b.inf
%WINDIR%\inf\prnlx00a.pnf
%WINDIR%\inf\prnlx00e.pnf
%WINDIR%\inf\prnlx004.inf
%WINDIR%\inf\prnlx002.inf
%WINDIR%\inf\prnlx008.pnf
%WINDIR%\inf\prnlx008.inf
%WINDIR%\inf\prnlx007.pnf
%WINDIR%\inf\prnlx007.inf
%WINDIR%\inf\prnlx006.pnf
%WINDIR%\inf\prnlx006.inf
%WINDIR%\inf\prnlx005.pnf
%WINDIR%\inf\prnlx005.inf
%WINDIR%\inf\prnlx009.inf
%WINDIR%\inf\prnrc002.inf
%WINDIR%\inf\prnsv003.pnf
%WINDIR%\inf\smsvchost 4.0.0.0\000c\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 3.0.0.0\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\000b\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\000a\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0009\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0008\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0007\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0006\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0005\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0001\_smsvchostperfcounters.ini
%WINDIR%\inf\prnsv004.inf
%WINDIR%\inf\smsvchost 4.0.0.0\000d\_smsvchostperfcounters.ini
%WINDIR%\inf\setupapi.ev3
%WINDIR%\inf\smartcrd.inf
%WINDIR%\inf\sisraid4.pnf
%WINDIR%\inf\sisraid4.inf
%WINDIR%\inf\sisraid2.pnf
%WINDIR%\inf\sisraid2.inf
%WINDIR%\inf\sffdisk.pnf
%WINDIR%\inf\sffdisk.inf
%WINDIR%\inf\setupapi.offline.log
%WINDIR%\inf\smartcrd.pnf
%WINDIR%\inf\smsvchost 3.0.0.0\_smsvchostperfcounters.h
%WINDIR%\inf\smsvchost 4.0.0.0\000e\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0804\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0816\_smsvchostperfcounters.ini
%WINDIR%\inf\tape.pnf
%WINDIR%\inf\tape.inf
%WINDIR%\inf\synth3dvsc.inf
%WINDIR%\inf\sti.pnf
%WINDIR%\inf\sti.inf
%WINDIR%\inf\stexstor.pnf
%WINDIR%\inf\stexstor.inf
%WINDIR%\inf\smsvchost 4.0.0.0\_smsvchostperfcounters.h
%WINDIR%\inf\tdibth.inf
%WINDIR%\inf\smsvchost 4.0.0.0\0010\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0011\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0404\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\001f\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\001d\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0019\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0015\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0014\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0013\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0012\_smsvchostperfcounters.ini
%WINDIR%\inf\smsvchost 4.0.0.0\0416\_smsvchostperfcounters.ini
%WINDIR%\inf\mdmsun2.pnf
%WINDIR%\inf\prnky003.inf
%WINDIR%\inf\setupapi.dev.log
%WINDIR%\inf\ql2300.inf
%WINDIR%\inf\rawsilo.pnf
%WINDIR%\inf\rawsilo.inf
%WINDIR%\inf\ramdisk.pnf
%WINDIR%\inf\ramdisk.inf
%WINDIR%\inf\ql40xx2.pnf
%WINDIR%\inf\ql40xx2.inf
%WINDIR%\inf\ql40xx.pnf
%WINDIR%\inf\ql40xx.inf
%WINDIR%\inf\setupapi.ev1
%WINDIR%\inf\rdpbus.inf
%WINDIR%\inf\qd3x64.pnf
%WINDIR%\inf\qd3x64.inf
%WINDIR%\inf\prnxx002.pnf
%WINDIR%\inf\prnxx002.inf
%WINDIR%\inf\prnts003.pnf
%WINDIR%\inf\prnts003.inf
%WINDIR%\inf\prnts002.pnf
%WINDIR%\inf\prnts002.inf
%WINDIR%\inf\prnsv004.pnf
%WINDIR%\inf\ql2300.pnf
%WINDIR%\inf\setupapi.ev2
%WINDIR%\inf\rdpbus.pnf
%WINDIR%\inf\ricoh.pnf
%WINDIR%\inf\rdvgwddm.inf
%WINDIR%\inf\setupapi.app.log
%WINDIR%\inf\servicemodelservice 3.0.0.0\_servicemodelserviceperfcounters.ini
%WINDIR%\inf\servicemodelservice 3.0.0.0\_servicemodelserviceperfcounters.h
%WINDIR%\inf\servicemodeloperation 3.0.0.0\_servicemodeloperationperfcounters.ini
%WINDIR%\inf\servicemodeloperation 3.0.0.0\_servicemodeloperationperfcounters.h
%WINDIR%\inf\servicemodelendpoint 3.0.0.0\_servicemodelendpointperfcounters.ini
%WINDIR%\inf\servicemodelendpoint 3.0.0.0\_servicemodelendpointperfcounters.h
%WINDIR%\inf\sensorsalsdriver.inf
%WINDIR%\inf\ricoh.inf
%WINDIR%\inf\sdbus.pnf
%WINDIR%\inf\rdlsbuscbs.inf
%WINDIR%\inf\scsidev.inf
%WINDIR%\inf\scrawpdo.pnf
%WINDIR%\inf\scrawpdo.inf
%WINDIR%\inf\sbp2.pnf
%WINDIR%\inf\sbp2.inf
%WINDIR%\inf\rspndr.pnf
%WINDIR%\inf\rndiscmp.pnf
%WINDIR%\inf\rndiscmp.inf
%WINDIR%\inf\sdbus.inf
%WINDIR%\syswow64\wdi\perftrack\healthcentercplinstrumentation.ptxml
%WINDIR%\inf\mdmsun2.inf
%WINDIR%\inf\mdmrock5.inf
%WINDIR%\inf\asp.net_1.1.4322\0001\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\000d\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\000c\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\000b\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\000a\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0009\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0008\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0007\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0006\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0005\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0000\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0010\aspnet_perf.ini
%WINDIR%\inf\asp.net\aspnet_perf.h
%WINDIR%\inf\asp.net\0816\aspnet_perf2.ini
%WINDIR%\inf\asp.net\0804\aspnet_perf2.ini
%WINDIR%\inf\asp.net\0416\aspnet_perf2.ini
%WINDIR%\inf\asp.net\0404\aspnet_perf2.ini
%WINDIR%\inf\asp.net\001f\aspnet_perf2.ini
%WINDIR%\inf\asp.net\001d\aspnet_perf2.ini
%WINDIR%\inf\asp.net\0006\aspnet_perf2.ini
%WINDIR%\inf\asp.net_1.1.4322\0011\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\000b\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0816\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\aspnet_perf.h
%WINDIR%\inf\asp.net_4.0.30319\000a\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0009\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0008\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0007\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0006\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0005\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0001\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0000\aspnet_perf.ini
%WINDIR%\inf\asp.net\0019\aspnet_perf2.ini
%WINDIR%\inf\asp.net\0015\aspnet_perf2.ini
%WINDIR%\inf\asp.net_1.1.4322\0012\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0416\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0404\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\001f\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\001d\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0019\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0015\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0014\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0013\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\0804\aspnet_perf.ini
%WINDIR%\inf\asp.net_1.1.4322\000e\aspnet_perf.ini
%WINDIR%\inf\asp.net\0014\aspnet_perf2.ini
%WINDIR%\inf\asp.net\0013\aspnet_perf2.ini
%WINDIR%\inf\asp.net_4.0.30319\000c\aspnet_perf.ini
%WINDIR%\inf\adpahci.pnf
%WINDIR%\inf\amdsbs.inf
%WINDIR%\inf\amdsata.pnf
%WINDIR%\inf\amdsata.inf
%WINDIR%\inf\agp.pnf
%WINDIR%\inf\agp.inf
%WINDIR%\inf\af9035bda.pnf
%WINDIR%\inf\af9035bda.inf
%WINDIR%\inf\angel264.pnf
%WINDIR%\inf\adpu320.pnf
%WINDIR%\inf\adpu320.inf
%WINDIR%\inf\adpahci.inf
%WINDIR%\inf\adp94xx.pnf
%WINDIR%\inf\adp94xx.inf
%WINDIR%\inf\acpipmi.pnf
%WINDIR%\inf\acpipmi.inf
%WINDIR%\inf\acpi.pnf
%WINDIR%\inf\acpi.inf
%WINDIR%\inf\61883.pnf
%WINDIR%\inf\angel264.inf
%WINDIR%\inf\1394.pnf
%WINDIR%\inf\angel64.pnf
%WINDIR%\inf\angelu64.pnf
%WINDIR%\inf\asp.net\0012\aspnet_perf2.ini
%WINDIR%\inf\angel64.inf
%WINDIR%\inf\asp.net\0011\aspnet_perf2.ini
%WINDIR%\inf\asp.net\0010\aspnet_perf2.ini
%WINDIR%\inf\asp.net\000e\aspnet_perf2.ini
%WINDIR%\inf\asp.net\000d\aspnet_perf2.ini
%WINDIR%\inf\asp.net\000c\aspnet_perf2.ini
%WINDIR%\inf\asp.net\000b\aspnet_perf2.ini
%WINDIR%\inf\asp.net\000a\aspnet_perf2.ini
%WINDIR%\inf\angelu64.inf
%WINDIR%\inf\asp.net\0009\aspnet_perf2.ini
%WINDIR%\inf\asp.net\0007\aspnet_perf2.ini
%WINDIR%\inf\amdsbs.pnf
%WINDIR%\inf\asp.net\0005\aspnet_perf2.ini
%WINDIR%\inf\asp.net\0001\aspnet_perf2.ini
%WINDIR%\inf\asp.net\0000\aspnet_perf2.ini
%WINDIR%\inf\arcsas.pnf
%WINDIR%\inf\arcsas.inf
%WINDIR%\inf\arc.pnf
%WINDIR%\inf\arc.inf
%WINDIR%\inf\asp.net\0008\aspnet_perf2.ini
%WINDIR%\inf\61883.inf
%WINDIR%\inf\asp.net_4.0.30319\000d\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0416\aspnet_perf.ini
%WINDIR%\inf\brmfcsto.pnf
%WINDIR%\inf\brmfcsto.inf
%WINDIR%\inf\brmfcmf.pnf
%WINDIR%\inf\brmfcmf.inf
%WINDIR%\inf\brmfcmdm.pnf
%WINDIR%\inf\brmfcmdm.inf
%WINDIR%\inf\blbdrive.pnf
%WINDIR%\inf\blbdrive.inf
%WINDIR%\inf\bda.pnf
%WINDIR%\inf\battery.pnf
%WINDIR%\inf\brmfcumd.pnf
%WINDIR%\inf\battery.inf
%WINDIR%\inf\avmx64c.pnf
%WINDIR%\inf\avmx64c.inf
%WINDIR%\inf\averhbh826_noaverir_x64.pnf
%WINDIR%\inf\averhbh826_noaverir_x64.inf
%WINDIR%\inf\averfx2swtv_x64.pnf
%WINDIR%\inf\averfx2swtv_x64.inf
%WINDIR%\inf\averfx2swtv_noavin_x64.pnf
%WINDIR%\inf\bda.inf
%WINDIR%\inf\averfx2hbtv_x64.inf
%WINDIR%\inf\brmfcwia.inf
%WINDIR%\inf\cpu.pnf
%WINDIR%\inf\cpu.inf
%WINDIR%\inf\compositebus.pnf
%WINDIR%\inf\compositebus.inf
%WINDIR%\inf\circlass.pnf
%WINDIR%\inf\circlass.inf
%WINDIR%\inf\cdrom.pnf
%WINDIR%\inf\cdrom.inf
%WINDIR%\inf\bthspp.pnf
%WINDIR%\inf\averfx2swtv_noavin_x64.inf
%WINDIR%\inf\brmfcumd.inf
%WINDIR%\inf\bthprint.inf
%WINDIR%\inf\bthpan.pnf
%WINDIR%\inf\bthpan.inf
%WINDIR%\inf\bthmtpenum.pnf
%WINDIR%\inf\bthmtpenum.inf
%WINDIR%\inf\bth.pnf
%WINDIR%\inf\bth.inf
%WINDIR%\inf\brmfport.pnf
%WINDIR%\inf\brmfport.inf
%WINDIR%\inf\bthprint.pnf
%WINDIR%\inf\brmfcwia.pnf
%WINDIR%\inf\averfx2hbtv_x64.pnf
%WINDIR%\inf\averfx2hbh826d_noaverir_x64.pnf
%WINDIR%\prefetch\vssvc.exe-b8afc319.pf
%WINDIR%\inf\asp.net_4.0.30319\0804\aspnet_perf.ini
%WINDIR%\inf\aspnet_state\0007\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0006\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0005\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0004\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0001\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0000\aspnet_state_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\aspnet_perf.h
%WINDIR%\inf\asp.net_4.0.30319\0816\aspnet_perf.ini
%WINDIR%\inf\aspnet_state\0008\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0009\aspnet_state_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\000e\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\001f\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\001d\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0019\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0015\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0014\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0013\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0012\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0011\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0404\aspnet_perf.ini
%WINDIR%\inf\asp.net_4.0.30319\0010\aspnet_perf.ini
%WINDIR%\inf\aspnet_state\000a\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0019\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\001d\aspnet_state_perf.ini
%WINDIR%\inf\avc.pnf
%WINDIR%\inf\avc.inf
%WINDIR%\inf\atiriol6.pnf
%WINDIR%\inf\atiriol6.inf
%WINDIR%\inf\atiilhag.pnf
%WINDIR%\inf\atiilhag.inf
%WINDIR%\inf\aspnet_state\aspnet_state_perf.h
%WINDIR%\inf\aspnet_state\001f\aspnet_state_perf.ini
%WINDIR%\inf\averfx2hbh826d_noaverir_x64.inf
%WINDIR%\inf\aspnet_state\000b\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\000c\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0015\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0014\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0013\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0012\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0011\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0010\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\000e\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\000d\aspnet_state_perf.ini
%WINDIR%\inf\aspnet_state\0016\aspnet_state_perf.ini
%WINDIR%\inf\1394.inf
%WINDIR%\inf\.net memory cache 4.0\netmemorycache.h
%WINDIR%\inf\.net memory cache 4.0\0009\netmemorycache.ini
%WINDIR%\prefetch\msohtmed.exe-68e5ab1e.pf
%WINDIR%\prefetch\msohtmed.exe-35a8ca79.pf
%WINDIR%\prefetch\msif1a9.tmp-fa1ca0e9.pf
%WINDIR%\prefetch\msiexec.exe-e09a077a.pf
%WINDIR%\prefetch\msiexec.exe-a2d55cb6.pf
%WINDIR%\prefetch\msieb32.tmp-a0d60608.pf
%WINDIR%\prefetch\msidf38.tmp-4231cf8d.pf
%WINDIR%\prefetch\msi6837.tmp-63debe2c.pf
%WINDIR%\prefetch\msi419f.tmp-b24cc418.pf
%WINDIR%\prefetch\mscorsvw.exe-c3c515bd.pf
%WINDIR%\prefetch\netsh.exe-f1b6da12.pf
%WINDIR%\prefetch\mscorsvw.exe-57d17daf.pf
%WINDIR%\prefetch\msconfig.exe-3a52734e.pf
%WINDIR%\prefetch\mofcomp.exe-fde76efc.pf
%WINDIR%\prefetch\mofcomp.exe-8fe3d558.pf
%WINDIR%\prefetch\mmc.exe-f5dc4f82.pf
%WINDIR%\prefetch\mmc.exe-f39cded6.pf
%WINDIR%\prefetch\mmc.exe-53159585.pf
%WINDIR%\prefetch\mstsc.exe-5283258e.pf
%WINDIR%\prefetch\msdtc.exe-cc1dec77.pf
%WINDIR%\prefetch\setup_wm.exe-d33fd27d.pf
%WINDIR%\prefetch\ngen.exe-7900743e.pf
%WINDIR%\prefetch\setup.exe-7c026c7f.pf
%WINDIR%\prefetch\schtasks.exe-5ca45734.pf
%WINDIR%\prefetch\sc.exe-945d79ae.pf
%WINDIR%\prefetch\regtlib.exe-e21980a2.pf
%WINDIR%\prefetch\regsvcs.exe-a54ad617.pf
%WINDIR%\prefetch\regedit.exe-90feea06.pf
%WINDIR%\prefetch\rdrcef.exe-5852a8de.pf
%WINDIR%\prefetch\powerpnt.exe-158b76a4.pf
%WINDIR%\prefetch\migpolwin.exe-79e606fc.pf
%WINDIR%\prefetch\pfsvperfstats.bin
%WINDIR%\prefetch\mstsc.exe-76a46e8a.pf
%WINDIR%\prefetch\ose00001.exe-3da4b844.pf
%WINDIR%\prefetch\ose.exe-533d8ac9.pf
%WINDIR%\prefetch\ose.exe-51c16f0e.pf
%WINDIR%\prefetch\opera_crashreporter.exe-e30ebed0.pf
%WINDIR%\prefetch\opera.exe-9dd4e019.pf
%WINDIR%\prefetch\ntosboot-b00dfaad.pf
%WINDIR%\prefetch\ngen.exe-ec3f9239.pf
%WINDIR%\prefetch\ngen.exe-ae594a6b.pf
%WINDIR%\prefetch\pcaui.exe-3e82c312.pf
%WINDIR%\prefetch\microsoft toolkit.exe-9dae6a40.pf
%WINDIR%\prefetch\setup.exe-d0f6149e.pf
%WINDIR%\prefetch\mdm.exe-ea9906df.pf
%WINDIR%\prefetch\manageddbgca.exe-6ea1439b.pf
%WINDIR%\prefetch\dbgclr.exe-ad18e06e.pf
%WINDIR%\prefetch\setup.exe-f034c93c.pf
%WINDIR%\prefetch\conhost.exe-1f3e9d7e.pf
%WINDIR%\prefetch\cmd.exe-4a81b364.pf
%WINDIR%\prefetch\bcssync.exe-3f6c64a2.pf
%WINDIR%\prefetch\audiodg.exe-bdfd3029.pf
%WINDIR%\prefetch\aspnet_regiis.exe-b76f1ad7.pf
%WINDIR%\prefetch\arh.exe-f07e6c2c.pf
%WINDIR%\prefetch\agrobust.db
%WINDIR%\prefetch\defrag.exe-588f90ad.pf
%WINDIR%\prefetch\dexplore.exe-1749d792.pf
%WINDIR%\prefetch\aggluad_s-1-5-21-1960123792-2022915161-3775307078-1001.db
%WINDIR%\prefetch\agglfgapphistory.db
%WINDIR%\prefetch\agglfaulthistory.db
%WINDIR%\prefetch\agcx_sc4.db
%WINDIR%\prefetch\agapplaunch.db
%WINDIR%\prefetch\addinutil.exe-fef23417.pf
%WINDIR%\prefetch\acrord32.exe-acf2947d.pf
%WINDIR%\prefetch\1.exe-bf9d2cef.pf
%WINDIR%\temp\uddb22b.tmp
%WINDIR%\prefetch\aggluad_p_s-1-5-21-1960123792-2022915161-3775307078-1001.db
%WINDIR%\prefetch\agglglobalhistory.db
%WINDIR%\prefetch\osppsvc.exe-e53d3cc0.pf
%WINDIR%\prefetch\dllhost.exe-766398d2.pf
%WINDIR%\prefetch\firefox.exe-18acfcff.pf
%WINDIR%\prefetch\flashplayerupdateservice.exe-216d9c35.pf
%WINDIR%\prefetch\layout.ini
%WINDIR%\prefetch\launcher.exe-e41e51ee.pf
%WINDIR%\prefetch\kmsnano_setup.tmp-11a1562c.pf
%WINDIR%\prefetch\kmsnano_setup.exe-631a87c6.pf
%WINDIR%\prefetch\javaw.exe-dccf0ab8.pf
%WINDIR%\prefetch\ipconfig.exe-912f3d5b.pf
%WINDIR%\prefetch\install.exe-455f2d9b.pf
%WINDIR%\prefetch\iexplore.exe-4b6c9213.pf
%WINDIR%\prefetch\logonui.exe-09140401.pf
%WINDIR%\prefetch\dllhost.exe-5e46fa0d.pf
%WINDIR%\prefetch\control.exe-817f8f1d.pf
%WINDIR%\prefetch\excel.exe-53a22446.pf
%WINDIR%\prefetch\drvinst.exe-4cb4314a.pf
%WINDIR%\prefetch\dotnetfx.exe-fe16be11.pf
%WINDIR%\prefetch\dllhost.exe-ecb71776.pf
%WINDIR%\prefetch\dllhost.exe-d58da3a6.pf
%WINDIR%\prefetch\dllhost.exe-b2eb1806.pf
%WINDIR%\prefetch\dllhost.exe-861f96f8.pf
%WINDIR%\prefetch\dllhost.exe-7faa2e4c.pf
%WINDIR%\prefetch\explorer.exe-a80e4f97.pf
%WINDIR%\prefetch\msoxmled.exe-e473a01d.pf
%WINDIR%\prefetch\sppsvc.exe-b0f8131b.pf
%WINDIR%\inf\.net clr networking 4.0.0.0\0001\_networkingperfcounters.ini
%WINDIR%\syswow64\perfstringbackup.ini
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\7b2238aaccedc3f1ffe8e7eb5f575ec9
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\94308059b57b3142e455b38a6eb92015
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\7b2238aaccedc3f1ffe8e7eb5f575ec9
%WINDIR%\inf\wmiaprpl\0009\wmiaprpl.ini
%WINDIR%\inf\wmiaprpl\wmiaprpl.h
<DRIVERS>\etc\protocol
%WINDIR%\softwaredistribution\datastore\datastore.edb
%WINDIR%\prefetch\steamwebhelper.exe-93613764.pf
%WINDIR%\inf\.net clr networking 4.0.0.0\0005\_networkingperfcounters.ini
%WINDIR%\prefetch\readyboot\trace5.fx
%WINDIR%\softwaredistribution\datastore\logs\edbres00002.jrs
%WINDIR%\softwaredistribution\datastore\logs\edbres00001.jrs
%WINDIR%\softwaredistribution\datastore\logs\edb00001.log
%WINDIR%\softwaredistribution\datastore\logs\edb.log
%WINDIR%\softwaredistribution\datastore\logs\edb.chk
%TEMP%\protect4a647d98.dll
%WINDIR%\prefetch\readyboot\trace7.fx
%WINDIR%\prefetch\readyboot\trace6.fx
%WINDIR%\softwaredistribution\reportingevents.log
%WINDIR%\inf\netrasa.pnf
%WINDIR%\inf\.net clr networking 4.0.0.0\0006\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0013\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0014\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0816\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0804\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0416\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0404\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\001f\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\001d\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0019\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0015\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\_networkingperfcounters.h
%WINDIR%\inf\.net clr networking 4.0.0.0\0007\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0008\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0011\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0010\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\000e\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\000d\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\000c\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\000b\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\000a\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0009\_networkingperfcounters.ini
%WINDIR%\inf\.net clr networking 4.0.0.0\0012\_networkingperfcounters.ini
%WINDIR%\inf\bthspp.inf
%WINDIR%\inf\crcdisk.inf
%WINDIR%\prefetch\_iu14d2n.tmp-74616ced.pf
%WINDIR%\prefetch\test_msvcp110.exe-39f2672e.pf
%WINDIR%\prefetch\test_msvcp120d.exe-ed7dfbed.pf
%WINDIR%\prefetch\test_msvcp120d.exe-5e6bdb07.pf
%WINDIR%\prefetch\test_msvcp120.exe-9f64d86b.pf
%WINDIR%\prefetch\test_msvcp120.exe-5e9c35c1.pf
%WINDIR%\prefetch\test_msvcp110_x64.exe-600927fb.pf
%WINDIR%\prefetch\test_msvcp110d_x64.exe-6afaa41f.pf
%WINDIR%\prefetch\test_msvcp110d.exe-dd6c4bd2.pf
%WINDIR%\prefetch\test_msvcp110d.exe-6c7e6cb8.pf
%WINDIR%\prefetch\readyboot\trace3.fx
%WINDIR%\prefetch\test_msvcp120xp.exe-d7d05439.pf
%WINDIR%\prefetch\test_msvcp100_x64.exe-6e02575e.pf
%WINDIR%\prefetch\test_msvcp100d_x64.exe-24890c8a.pf
%WINDIR%\prefetch\test_msvcp100.exe-d47ff5f1.pf
%WINDIR%\prefetch\test_msvcp100.exe-93b75347.pf
%WINDIR%\prefetch\taskhost.exe-7238f31d.pf
%WINDIR%\prefetch\taskeng.exe-48d4e289.pf
%WINDIR%\prefetch\systempropertiesadvanced.exe-68c7c4f0.pf
%WINDIR%\prefetch\svchost.exe-80f4a784.pf
%WINDIR%\prefetch\svchost.exe-7ac6742a.pf
%WINDIR%\prefetch\test_msvcp110.exe-f929c484.pf
%WINDIR%\prefetch\readyboot\trace4.fx
%WINDIR%\prefetch\test_msvcp140.exe-6a49bae5.pf
%WINDIR%\prefetch\test_msvcp140d_xp.exe-b04bc36c.pf
%WINDIR%\prefetch\test_msvcp140d.exe-606af971.pf
%WINDIR%\prefetch\wmpnscfg.exe-fc0d39bf.pf
%WINDIR%\prefetch\wmplayer.exe-26c72a86.pf
%WINDIR%\prefetch\wmiprvse.exe-6768a320.pf
%WINDIR%\prefetch\wmiprvse.exe-1628051c.pf
%WINDIR%\prefetch\wmiadap.exe-f8dfdfa2.pf
%WINDIR%\prefetch\winword.exe-778f7c2b.pf
%WINDIR%\prefetch\wevtutil.exe-ef5861c4.pf
%WINDIR%\prefetch\wevtutil.exe-400d93e8.pf
%WINDIR%\prefetch\test_msvcp140d_x64.exe-3e4f6ade.pf
%WINDIR%\prefetch\wermgr.exe-0f2ac88c.pf
%WINDIR%\prefetch\test_msvcp120d_x64.exe-b16c3bb4.pf
%WINDIR%\prefetch\vs7jit.exe-aef49c84.pf
%WINDIR%\prefetch\unins000.exe-53663602.pf
%WINDIR%\prefetch\trustedinstaller.exe-3cc531e5.pf
%WINDIR%\prefetch\triggerkms.exe-7e8edfdc.pf
%WINDIR%\prefetch\test_msvcp90_x64.exe-cf1ecfbe.pf
%WINDIR%\prefetch\test_msvcp90.exe-29c5da51.pf
%WINDIR%\prefetch\test_msvcp140_x64.exe-361d99d2.pf
%WINDIR%\prefetch\test_msvcp140xp.exe-6d280b1d.pf
%WINDIR%\prefetch\werfault.exe-e69f695a.pf
%WINDIR%\inf\mdmairte.pnf
%WINDIR%\inf\mdmsun1.inf
%WINDIR%\inf\cxfalcon_ibv64.pnf
%WINDIR%\inf\mdmgl008.pnf
%WINDIR%\inf\mdmhandy.inf
%WINDIR%\inf\mdmhaeu.pnf
%WINDIR%\inf\mdmhaeu.inf
%WINDIR%\inf\mdmgsm.pnf
%WINDIR%\inf\mdmgsm.inf
%WINDIR%\inf\mdmgl010.pnf
%WINDIR%\inf\mdmgl010.inf
%WINDIR%\inf\mdmgl009.pnf
%WINDIR%\inf\mdmgl009.inf
%WINDIR%\inf\mdmgl008.inf
%WINDIR%\inf\mdmhay2.inf
%WINDIR%\inf\mdmgl007.pnf
%WINDIR%\inf\mdmgl007.inf
%WINDIR%\inf\mdmgl006.pnf
%WINDIR%\inf\mdmgl006.inf
%WINDIR%\inf\mdmgl005.pnf
%WINDIR%\inf\mdmgl005.inf
%WINDIR%\inf\mdmgl004.pnf
%WINDIR%\inf\mdmetech.pnf
%WINDIR%\inf\mdmhay2.pnf
%WINDIR%\inf\mdmlucnt.inf
%WINDIR%\inf\mdmjf56e.inf
%WINDIR%\inf\mdmjf56e.pnf
%WINDIR%\inf\mdmlasno.pnf
%WINDIR%\inf\mdmlasno.inf
%WINDIR%\inf\mdmlasat.pnf
%WINDIR%\inf\mdmlasat.inf
%WINDIR%\inf\mdmkortx.pnf
%WINDIR%\inf\mdmkortx.inf
%WINDIR%\inf\mdmke.pnf
%WINDIR%\inf\mdmke.inf
%WINDIR%\inf\mdmgl004.inf
%WINDIR%\inf\mdmgl003.pnf
%WINDIR%\inf\mdmhayes.inf
%WINDIR%\inf\mdmisdn.inf
%WINDIR%\inf\mdmirmdm.pnf
%WINDIR%\inf\mdmirmdm.inf
%WINDIR%\inf\mdmiodat.pnf
%WINDIR%\inf\mdmiodat.inf
%WINDIR%\inf\mdminfot.pnf
%WINDIR%\inf\mdminfot.inf
%WINDIR%\inf\mdmhayes.pnf
%WINDIR%\inf\mdmisdn.pnf
%WINDIR%\inf\mdmhandy.pnf
%WINDIR%\inf\mdmgl003.inf
%WINDIR%\inf\mdmgl002.pnf
%WINDIR%\inf\mdmlucnt.pnf
%WINDIR%\inf\mdmcxpv6.pnf
%WINDIR%\inf\mdmdp2.inf
%WINDIR%\inf\mdmdgitn.pnf
%WINDIR%\inf\mdmdgitn.inf
%WINDIR%\inf\mdmdf56f.pnf
%WINDIR%\inf\mdmdf56f.inf
%WINDIR%\inf\mdmdcm6.pnf
%WINDIR%\inf\mdmdcm6.inf
%WINDIR%\inf\mdmdsi.pnf
%WINDIR%\inf\mdmdcm5.pnf
%WINDIR%\inf\mdmdcm5.inf
%WINDIR%\inf\mdmcxpv6.inf
%WINDIR%\inf\mdmcxhv6.pnf
%WINDIR%\inf\mdmcxhv6.inf
%WINDIR%\inf\mdmcrtix.pnf
%WINDIR%\inf\mdmcrtix.inf
%WINDIR%\inf\mdmcpv.pnf
%WINDIR%\inf\mdmcpv.inf
%WINDIR%\inf\mdmcpq2.pnf
%WINDIR%\inf\mdmdsi.inf
%WINDIR%\inf\mdmcpq.pnf
%WINDIR%\inf\mdmdyna.pnf
%WINDIR%\inf\mdmeiger.pnf
%WINDIR%\inf\mdmgl002.inf
%WINDIR%\inf\mdmdyna.inf
%WINDIR%\inf\mdmgl001.pnf
%WINDIR%\inf\mdmgl001.inf
%WINDIR%\inf\mdmgen.pnf
%WINDIR%\inf\mdmgen.inf
%WINDIR%\inf\mdmgcs.pnf
%WINDIR%\inf\mdmgcs.inf
%WINDIR%\inf\mdmgatew.pnf
%WINDIR%\inf\mdmeiger.inf
%WINDIR%\inf\mdmgatew.inf
%WINDIR%\inf\mdmfj2.inf
%WINDIR%\inf\mdmdp2.pnf
%WINDIR%\inf\mdmetech.inf
%WINDIR%\inf\mdmeric2.pnf
%WINDIR%\inf\mdmeric2.inf
%WINDIR%\inf\mdmeric.pnf
%WINDIR%\inf\mdmeric.inf
%WINDIR%\inf\mdmelsa.pnf
%WINDIR%\inf\mdmelsa.inf
%WINDIR%\inf\mdmfj2.pnf
%WINDIR%\inf\mdmcpq2.inf
%WINDIR%\inf\mdmmc288.inf
%WINDIR%\inf\mdmmhrtz.inf
%WINDIR%\inf\mdmpin.pnf
%WINDIR%\inf\mdmpin.inf
%WINDIR%\inf\mdmpenr.pnf
%WINDIR%\inf\mdmpenr.inf
%WINDIR%\inf\mdmpace.pnf
%WINDIR%\inf\mdmpace.inf
%WINDIR%\inf\mdmosi.pnf
%WINDIR%\inf\mdmosi.inf
%WINDIR%\inf\mdmoptn.pnf
%WINDIR%\inf\mdmomrn3.pnf
%WINDIR%\inf\mdmpn1.pnf
%WINDIR%\inf\mdmomrn3.inf
%WINDIR%\inf\mdmolic.pnf
%WINDIR%\inf\mdmolic.inf
%WINDIR%\inf\mdmnttte.pnf
%WINDIR%\inf\mdmnttte.inf
%WINDIR%\inf\mdmnttp2.pnf
%WINDIR%\inf\mdmnttp2.inf
%WINDIR%\inf\mdmnttp.pnf
%WINDIR%\inf\mdmoptn.inf
%WINDIR%\inf\mdmnttme.inf
%WINDIR%\inf\mdmpp.inf
%WINDIR%\inf\mdmsonyu.pnf
%WINDIR%\inf\mdmsonyu.inf
%WINDIR%\inf\mdmsmart.pnf
%WINDIR%\inf\mdmsmart.inf
%WINDIR%\inf\mdmsii64.pnf
%WINDIR%\inf\mdmsii64.inf
%WINDIR%\inf\mdmsier.pnf
%WINDIR%\inf\mdmsier.inf
%WINDIR%\inf\mdmrock5.pnf
%WINDIR%\inf\mdmnttp.inf
%WINDIR%\inf\mdmpn1.inf
%WINDIR%\inf\mdmrock4.inf
%WINDIR%\inf\mdmrock3.pnf
%WINDIR%\inf\mdmrock3.inf
%WINDIR%\inf\mdmrock.pnf
%WINDIR%\inf\mdmrock.inf
%WINDIR%\inf\mdmracal.pnf
%WINDIR%\inf\mdmracal.inf
%WINDIR%\inf\mdmpsion.pnf
%WINDIR%\inf\mdmpsion.inf
%WINDIR%\inf\mdmrock4.pnf
%WINDIR%\inf\mdmpp.pnf
%WINDIR%\inf\mdmnttme.pnf
%WINDIR%\inf\mdmnttd6.pnf
%WINDIR%\inf\crcdisk.pnf
%WINDIR%\inf\mdmmhrtz.pnf
%WINDIR%\inf\mdmmot64.pnf
%WINDIR%\inf\mdmmot64.inf
%WINDIR%\inf\mdmmod.pnf
%WINDIR%\inf\mdmmod.inf
%WINDIR%\inf\mdmminij.pnf
%WINDIR%\inf\mdmminij.inf
%WINDIR%\inf\mdmmhzel.pnf
%WINDIR%\inf\mdmmhzel.inf
%WINDIR%\inf\mdmmoto1.inf
%WINDIR%\inf\mdmmoto1.pnf
%WINDIR%\inf\mdmmc288.pnf
%WINDIR%\inf\mdmmetri.inf
%WINDIR%\inf\mdmmega.pnf
%WINDIR%\inf\mdmmega.inf
%WINDIR%\inf\mdmmct.pnf
%WINDIR%\inf\mdmmct.inf
%WINDIR%\inf\mdmmcom.pnf
%WINDIR%\inf\mdmmcom.inf
%WINDIR%\inf\mdmmcd.pnf
%WINDIR%\inf\mdmmetri.pnf
%WINDIR%\inf\mdmmcd.inf
%WINDIR%\inf\mdmmotou.inf
%WINDIR%\inf\mdmnis5t.inf
%WINDIR%\inf\mdmnis5t.pnf
%WINDIR%\inf\mdmnttd2.pnf
%WINDIR%\inf\mdmnttd2.inf
%WINDIR%\inf\mdmntt1.pnf
%WINDIR%\inf\mdmntt1.inf
%WINDIR%\inf\mdmnova.pnf
%WINDIR%\inf\mdmnova.inf
%WINDIR%\inf\mdmnokia.pnf
%WINDIR%\inf\mdmnokia.inf
%WINDIR%\inf\mdmnttd6.inf
%WINDIR%\inf\mdmmotou.pnf
%WINDIR%\inf\mdmmts.inf
%WINDIR%\inf\mdmnis3t.inf
%WINDIR%\inf\mdmnis2u.pnf
%WINDIR%\inf\mdmnis2u.inf
%WINDIR%\inf\mdmnis1u.pnf
%WINDIR%\inf\mdmnis1u.inf
%WINDIR%\inf\mdmneuhs.pnf
%WINDIR%\inf\mdmneuhs.inf
%WINDIR%\inf\mdmmts.pnf
%WINDIR%\inf\mdmnis3t.pnf
%WINDIR%\inf\mdmcpq.inf
%WINDIR%\inf\mdmcomp.pnf
%WINDIR%\inf\mdmcomp.inf
%WINDIR%\inf\hidserv.pnf
%WINDIR%\inf\hidserv.inf
%WINDIR%\inf\hidirkbd.pnf
%WINDIR%\inf\hidirkbd.inf
%WINDIR%\inf\hidir.pnf
%WINDIR%\inf\hidir.inf
%WINDIR%\inf\hiddigi.pnf
%WINDIR%\inf\hiddigi.inf
%WINDIR%\inf\hidbth.pnf
%WINDIR%\inf\hdaudss.pnf
%WINDIR%\inf\hpoa1sd.pnf
%WINDIR%\inf\hdaudss.inf
%WINDIR%\inf\hdaudio.pnf
%WINDIR%\inf\hdaudio.inf
%WINDIR%\inf\hdaudbus.pnf
%WINDIR%\inf\hdaudbus.inf
%WINDIR%\inf\hcw85c64.pnf
%WINDIR%\inf\hcw85c64.inf
%WINDIR%\inf\hpoa1nd.pnf
%WINDIR%\inf\hidbth.inf
%WINDIR%\inf\iscsi.inf
%WINDIR%\inf\hpoa1so.inf
%WINDIR%\inf\input.pnf
%WINDIR%\inf\input.inf
%WINDIR%\inf\image.pnf
%WINDIR%\inf\image.inf
%WINDIR%\inf\iirsp2.pnf
%WINDIR%\inf\iirsp2.inf
%WINDIR%\inf\iirsp.pnf
%WINDIR%\inf\iirsp.inf
%WINDIR%\inf\hcw85b64.pnf
%WINDIR%\inf\igdlh.pnf
%WINDIR%\inf\hpoa1sd.inf
%WINDIR%\inf\iem\0409\inetcorp.iem
%WINDIR%\inf\iastorv.pnf
%WINDIR%\inf\iastorv.inf
%WINDIR%\inf\hpsamd.pnf
%WINDIR%\inf\hpsamd.inf
%WINDIR%\inf\hpoa1ss.pnf
%WINDIR%\inf\hpoa1ss.inf
%WINDIR%\inf\hpoa1so.pnf
%WINDIR%\inf\igdlh.inf
%WINDIR%\inf\hcw85b64.inf
%WINDIR%\inf\ipmidrv.inf
%WINDIR%\inf\hcw72b64.pnf
%WINDIR%\inf\hcw72b64.inf
%WINDIR%\inf\dot4.pnf
%WINDIR%\inf\ipmidrv.pnf
%WINDIR%\inf\divacx64.pnf
%WINDIR%\inf\divacx64.inf
%WINDIR%\inf\display.pnf
%WINDIR%\inf\display.inf
%WINDIR%\inf\disk.pnf
%WINDIR%\inf\disk.inf
%WINDIR%\inf\digitalmediadevice.pnf
%WINDIR%\inf\dot4prt.inf
%WINDIR%\inf\dot4prt.pnf
%WINDIR%\inf\digitalmediadevice.inf
%WINDIR%\inf\cxraptor_philipstuv1236d_ibv64.pnf
%WINDIR%\inf\cxraptor_philipstuv1236d_ibv64.inf
%WINDIR%\inf\cxraptor_fm1236mk5_ibv64.pnf
%WINDIR%\inf\cxraptor_fm1236mk5_ibv64.inf
%WINDIR%\inf\cxraptor_fm1216mk5_ibv64.pnf
%WINDIR%\inf\cxraptor_fm1216mk5_ibv64.inf
%WINDIR%\inf\cxfalpal_ibv64.pnf
%WINDIR%\inf\cxfalpal_ibv64.inf
%WINDIR%\inf\dc21x4vm.pnf
%WINDIR%\inf\dc21x4vm.inf
%WINDIR%\inf\iem\0409\inetset.iem
%WINDIR%\inf\eaphost.pnf
%WINDIR%\inf\faxcn001.pnf
%WINDIR%\inf\faxcn002.inf
%WINDIR%\inf\hal.inf
%WINDIR%\inf\gameport.pnf
%WINDIR%\inf\gameport.inf
%WINDIR%\inf\flpydisk.pnf
%WINDIR%\inf\flpydisk.inf
%WINDIR%\inf\fdc.pnf
%WINDIR%\inf\fdc.inf
%WINDIR%\inf\faxcn002.pnf
%WINDIR%\inf\hal.pnf
%WINDIR%\inf\eaphost.inf
%WINDIR%\inf\dot4.inf
%WINDIR%\inf\faxca003.pnf
%WINDIR%\inf\faxca003.inf
%WINDIR%\inf\elxstor.pnf
%WINDIR%\inf\elxstor.inf
%WINDIR%\inf\ehstorpwddrv.pnf
%WINDIR%\inf\ehstorpwddrv.inf
%WINDIR%\inf\ehstorcertdrv.pnf
%WINDIR%\inf\ehstorcertdrv.inf
%WINDIR%\inf\faxcn001.inf
%WINDIR%\inf\hpoa1nd.inf
%WINDIR%\inf\iscsi.pnf
%WINDIR%\inf\mdmbr007.pnf
%WINDIR%\inf\mdmbr002.inf
%WINDIR%\inf\mdmbr007.inf
%WINDIR%\inf\mdmbr006.pnf
%WINDIR%\inf\mdmbr006.inf
%WINDIR%\inf\mdmbr005.pnf
%WINDIR%\inf\mdmbr005.inf
%WINDIR%\inf\mdmbr004.pnf
%WINDIR%\inf\mdmbr004.inf
%WINDIR%\inf\mdmbr002.pnf
%WINDIR%\inf\keyboard.inf
%WINDIR%\inf\mdmbr008.inf
%WINDIR%\inf\mdmarch.pnf
%WINDIR%\inf\mdmaus.pnf
%WINDIR%\inf\mdmaus.inf
%WINDIR%\inf\mdmatm2k.pnf
%WINDIR%\inf\mdmatm2k.inf
%WINDIR%\inf\mdmati.pnf
%WINDIR%\inf\mdmati.inf
%WINDIR%\inf\mdmarn.pnf
%WINDIR%\inf\mdmarn.inf
%WINDIR%\inf\mdmboca.inf
%WINDIR%\inf\mdmboca.pnf
%WINDIR%\inf\mdmbr008.pnf
%WINDIR%\inf\mdmc26a.pnf
%WINDIR%\inf\mdmcdp.inf
%WINDIR%\inf\mdmcommu.inf
%WINDIR%\inf\mdmcom1.pnf
%WINDIR%\inf\mdmcom1.inf
%WINDIR%\inf\mdmcodex.pnf
%WINDIR%\inf\mdmcodex.inf
%WINDIR%\inf\mdmcm28.pnf
%WINDIR%\inf\mdmcm28.inf
%WINDIR%\inf\mdmcdp.pnf
%WINDIR%\inf\mdmcommu.pnf
%WINDIR%\inf\mdmbr00a.inf
%WINDIR%\inf\mdmbr00a.pnf
%WINDIR%\inf\mdmbw561.pnf
%WINDIR%\inf\mdmbw561.inf
%WINDIR%\inf\mdmbug3.pnf
%WINDIR%\inf\mdmbug3.inf
%WINDIR%\inf\mdmbtmdm.pnf
%WINDIR%\inf\mdmbtmdm.inf
%WINDIR%\inf\mdmbsb.pnf
%WINDIR%\inf\mdmbsb.inf
%WINDIR%\inf\mdmc26a.inf
%WINDIR%\inf\mdmsun1.pnf
%WINDIR%\inf\cxfalcon_ibv64.inf
%WINDIR%\inf\mdmar1.inf
%WINDIR%\inf\lsi_fc.pnf
%WINDIR%\inf\mchgr.inf
%WINDIR%\inf\machine.pnf
%WINDIR%\inf\machine.inf
%WINDIR%\inf\lsi_scsi.pnf
%WINDIR%\inf\lsi_scsi.inf
%WINDIR%\inf\lsi_sas2.pnf
%WINDIR%\inf\lsi_sas2.inf
%WINDIR%\inf\lsi_sas.pnf
%WINDIR%\inf\mdmar1.pnf
%WINDIR%\inf\mcx2.inf
%WINDIR%\inf\lsi_fc.inf
%WINDIR%\inf\lltdio.pnf
%WINDIR%\inf\ksfilter.pnf
%WINDIR%\inf\ksfilter.inf
%WINDIR%\inf\kscaptur.pnf
%WINDIR%\inf\kscaptur.inf
%WINDIR%\inf\ks.pnf
%WINDIR%\inf\ks.inf
%WINDIR%\inf\keyboard.pnf
%WINDIR%\inf\lsi_sas.inf
%WINDIR%\inf\mdmarch.inf
%WINDIR%\inf\mcx2.pnf
%WINDIR%\inf\mdm5674a.inf
%WINDIR%\inf\mdm3com.inf
%WINDIR%\inf\mdmaiwat.pnf
%WINDIR%\inf\mdmaiwat.inf
%WINDIR%\inf\mdmaiwa5.pnf
%WINDIR%\inf\mdmaiwa5.inf
%WINDIR%\inf\mdmaiwa4.pnf
%WINDIR%\inf\mdmaiwa4.inf
%WINDIR%\inf\mdmaiwa3.pnf
%WINDIR%\inf\mdmaiwa3.inf
%WINDIR%\inf\mdm3com.pnf
%WINDIR%\inf\mdmaiwa.pnf
%WINDIR%\inf\mchgr.pnf
%WINDIR%\inf\mdmairte.inf
%WINDIR%\inf\mdmags64.pnf
%WINDIR%\inf\mdmags64.inf
%WINDIR%\inf\mdmagm64.pnf
%WINDIR%\inf\mdmagm64.inf
%WINDIR%\inf\mdmadc.pnf
%WINDIR%\inf\mdmadc.inf
%WINDIR%\inf\mdm5674a.pnf
%WINDIR%\inf\mdmaiwa.inf
%WINDIR%\syswow64\wdi\perftrack\timedate.ptxml

Miscellaneous

Searches for the following windows

ClassName: '18467-41' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%APPDATA%\cleaner7.exe'
'%APPDATA%\amidewin.exe' /SS 15626-SS-143
'%APPDATA%\amidewin.exe' /BS 23560-BS-22291
'%APPDATA%\amidewin.exe' /BV 9889-BV-15777
'%APPDATA%\amidewin.exe' /SK 17552-SK-6224
'%APPDATA%\amidewin.exe' /SU AUTO
'%APPDATA%\amidewin.exe' /SU 21996-SU-31754
'%APPDATA%\amidewin.exe' /SV 1057-SV-507
'%APPDATA%\cleaner8.exe'
'%APPDATA%\amidewin.exe' /BM 15174-BM-17717
'%APPDATA%\volumeid64.exe' c: 3381-2236 /accepteula
'%APPDATA%\cleanerold1.exe'
'%APPDATA%\reset_adapters.exe'
'%APPDATA%\1-runfirst.exe'
'%APPDATA%\cleaner2.exe'
'%APPDATA%\no-rundevcon.exe' rescan
'%APPDATA%\cleaner4.exe'
'%APPDATA%\amidewin.exe' /BS 30524-BS-26520
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH WINSOCK RESET"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH INTERFACE TCP RESET"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH INTERFACE IPV6 RESET"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH INTERFACE IPV4 RESET"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKCU\SOFTWARE\Epic Games" /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /s /c "fsutil dirty query %systemdrive%"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\WOW6432Node\EpicGames" /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\EpicGames" /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteClient-Win64-Shipping.exe" /T /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH INT IP RESET"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "WMIC LOGICALDISK GET NAME"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1002\Software\Epic Games" /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1004\Software\Epic Games" /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKCR\com.epicgames.launcher" /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteClient-Win64-Shipping_EAC.exe" /T /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "WMIC USERACCOUNT GET SID"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-500\Software\Epic Games" /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteLauncher.exe" /T /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH INT RESET ALL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\WOW6432Node\Epic Games" /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "EpicGamesLauncher.exe" /T /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1001\Software\Epic Games" /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\Classes\com.epicgames.launcher" /F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-501\Software\Epic Games" /F"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c "%TEMP%\46BF.tmp\46D0.tmp\46D1.bat <Full path to file>"
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKCU\SOFTWARE\Epic Games" /F"
'<SYSTEM32>\reg.exe' DELETE "HKCU\SOFTWARE\Epic Games" /F
'<SYSTEM32>\cmd.exe' /d /s /c "WMIC LOGICALDISK GET NAME"
'<SYSTEM32>\wbem\wmic.exe' LOGICALDISK GET NAME
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH WINSOCK RESET"
'<SYSTEM32>\netsh.exe' WINSOCK RESET
'<SYSTEM32>\cmd.exe' /c ipconfig /flushdns > nul 2> nul
'<SYSTEM32>\ipconfig.exe' /flushdns
'<SYSTEM32>\cmd.exe' /c ipconfig /release > nul 2> nul
'<SYSTEM32>\ipconfig.exe' /release
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH INT IP RESET"
'<SYSTEM32>\netsh.exe' INT IP RESET
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\EpicGames" /F"
'<SYSTEM32>\reg.exe' DELETE "HKLM\SOFTWARE\EpicGames" /F
'<SYSTEM32>\cmd.exe' /c ipconfig /renew > nul 2> nul
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH INTERFACE IPV4 RESET"
'<SYSTEM32>\netsh.exe' INTERFACE IPV4 RESET
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH INTERFACE IPV6 RESET"
'<SYSTEM32>\netsh.exe' INTERFACE IPV6 RESET
'<SYSTEM32>\cmd.exe' /c pause
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH INTERFACE TCP RESET"
'<SYSTEM32>\netsh.exe' INTERFACE TCP RESET
'<SYSTEM32>\cmd.exe' /d /s /c "NETSH INT RESET ALL"
'<SYSTEM32>\netsh.exe' INT RESET ALL
'<SYSTEM32>\ping.exe' /n 1 localhost
'<SYSTEM32>\ping.exe' /n 2 localhost
'<SYSTEM32>\ping.exe' 1.2.3.4 -n 1 -w 1000
'<SYSTEM32>\ipconfig.exe' /renew
'<SYSTEM32>\cmd.exe' /c .\reset_adapters.exe
'<SYSTEM32>\reg.exe' DELETE "HKLM\SOFTWARE\WOW6432Node\EpicGames" /F
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\WOW6432Node\EpicGames" /F"
'<SYSTEM32>\reg.exe' DELETE "HKLM\SOFTWARE\WOW6432Node\Epic Games" /F
'<SYSTEM32>\cmd.exe' /S /D /c" echo Y "
'<SYSTEM32>\cmd.exe' /S /D /c" start "" /wait /b %APPDATA%\cleanerOLD1.exe"
'<SYSTEM32>\fsutil.exe' dirty query C
'<SYSTEM32>\cmd.exe' /S /D /c" start "" /wait /b %APPDATA%\Cleaner8.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "EpicGamesLauncher.exe" /T /F"
'<SYSTEM32>\cmd.exe' /S /D /c" start "" /wait /b %APPDATA%\1-RUNFIRST.exe"
'<SYSTEM32>\cmd.exe' /S /D /c" start "" /wait /b %APPDATA%\reset_adapters.exe"
'<SYSTEM32>\ping.exe' localhost -n 2
'<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteClient-Win64-Shipping.exe" /T /F"
'<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteClient-Win64-Shipping_EAC.exe" /T /F"
'<SYSTEM32>\cmd.exe' /d /s /c "TASKKILL /IM "FortniteLauncher.exe" /T /F"
'<SYSTEM32>\cmd.exe' /d /s /c "WMIC USERACCOUNT GET SID"
'<SYSTEM32>\wbem\wmic.exe' USERACCOUNT GET SID
'<SYSTEM32>\cmd.exe' /s /c "fsutil dirty query %systemdrive%"
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-500\Software\Epic Games" /F"
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1004\Software\Epic Games" /F"
'<SYSTEM32>\reg.exe' DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1004\Software\Epic Games" /F
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-501\Software\Epic Games" /F"
'<SYSTEM32>\reg.exe' DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-501\Software\Epic Games" /F
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1002\Software\Epic Games" /F"
'<SYSTEM32>\reg.exe' DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1002\Software\Epic Games" /F
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1001\Software\Epic Games" /F"
'<SYSTEM32>\reg.exe' DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-1001\Software\Epic Games" /F
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKCR\com.epicgames.launcher" /F"
'<SYSTEM32>\reg.exe' DELETE "HKCR\com.epicgames.launcher" /F
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\Classes\com.epicgames.launcher" /F"
'<SYSTEM32>\reg.exe' DELETE "HKLM\SOFTWARE\Classes\com.epicgames.launcher" /F
'<SYSTEM32>\cmd.exe' /d /s /c "REG DELETE "HKLM\SOFTWARE\WOW6432Node\Epic Games" /F"
'<SYSTEM32>\reg.exe' DELETE "HKEY_USERS\S-1-5-21-1960123792-2022915161-3775307078-500\Software\Epic Games" /F
'<SYSTEM32>\ping.exe' www.google.com -n 1
'<SYSTEM32>\find.exe' "TTL="

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней