#!/usr/bin/perl # # prefhashcalc.pl v0.1, written by Hexacorn.com, 2012-06 # # The script calculates Prefetch file names for a given path for a couple # of common Windows versions # - Windows XP 32-bit # - Windows Vista 32-bit # - Windows 7 32-bit # - Windows 7 64-bit # - Windows Server 2003 32-bit # - Windows Server 2008 32-bit # - Windows Server 2008 64-bit # # Usage: # prefhashcalc.pl " " # # OR # # prefhashcalc.pl # where filelist contians rows with path, command line, description separated by | # e.g. # \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL ncpa.cpl|Network Connections # # OR # # prefhashcalc.pl # # # If you find any bugs please let me know use strict; use warnings; use bignum; $|=1; print STDERR " ====================================================================== prefhashcalc v0.1, written by Hexacorn.com, 2012-06 ====================================================================== Prefetch hash calculator, and lookup table generator "; my $arg1 = shift; my $arg2 = shift; if (!defined($arg1)) { show_all_known(); } else { $arg2 = '' if !defined ($arg2); if ($arg1 =~ /^[-\/]f$/i) { print STDERR "Procesing '$arg2'\n"; open F,"<$arg2" || die ("\nCan't open '$arg2'\n"); binmode F; while () { s/[\r\n]+//; next if /^\s*$/; my @r=split(/\|/); next if !defined($r[0]); $r[1]='' if !defined($r[1]); $r[2]='' if !defined($r[2]); print STDOUT calc_prefetch_xp ($r[0],$r[1],'XP (32-bit)'.$r[2]); print STDOUT calc_prefetch_vista ($r[0],$r[1],'Vista (32-bit)'.$r[2]); print STDOUT calc_prefetch_w7 ($r[0],$r[1],'W7 (32-bit)'.$r[2]); print STDOUT calc_prefetch_2k3 ($r[0],$r[1],'2003 (32-bit)'.$r[2]); print STDOUT calc_prefetch_2k8 ($r[0],$r[1],'2008 (32-bit)'.$r[2]); print STDOUT calc_prefetch_w7_64 ($r[0],$r[1],'W7 (64-bit)'.$r[2]); } close F; } else { print STDOUT calc_prefetch_xp ($arg1,$arg2,'XP (32-bit)'); print STDOUT calc_prefetch_vista ($arg1,$arg2,'Vista (32-bit)'); print STDOUT calc_prefetch_w7 ($arg1,$arg2,'W7 (32-bit)'); print STDOUT calc_prefetch_2k3 ($arg1,$arg2,'2003 (32-bit)'); print STDOUT calc_prefetch_2k8 ($arg1,$arg2,'2008 (32-bit)'); print STDOUT calc_prefetch_w7_64 ($arg1,$arg2,'W7 (64-bit)'); } } sub calc_prefetch_w7 { my $origpath = shift; my $cmdline = shift; my $desc = shift; die "\"$cmdline\" is not prefixed with at least one blank character\n" if ($cmdline ne '' & $cmdline !~ /^\s/); my $devpath = uc($origpath); my ($filename) = $devpath =~ /([^\\\/]+?)$/; $devpath =~ s#^([C-Z]):\\#sprintf("\\DEVICE\\HARDDISKVOLUME%s\\",ord($1)-ord('A'))#es; my $devpath_u = a2u($devpath); my $hash = hash_w7($devpath_u); if ($cmdline ne ''&&$origpath =~ /(rundll32|dllhost|mmc|svchost)\.exe/i) { $hash = ( $hash + hash_w7(a2u('"'.$origpath.'"'.$cmdline)) ) % 4294967296; } return "$desc\t".sprintf("$filename-%08lX.pf",$hash)."\t$origpath\t$cmdline\t$devpath\n"; } sub calc_prefetch_w7_64 { my $origpath = shift; my $cmdline = shift; my $desc = shift; die "\"$cmdline\" is not prefixed with at least one blank character\n" if ($cmdline ne '' & $cmdline !~ /^\s/); my $devpath = uc($origpath); my ($filename) = $devpath =~ /([^\\\/]+?)$/; $devpath =~ s#^([C-Z]):\\#sprintf("\\DEVICE\\HARDDISKVOLUME%s\\",ord($1)-ord('A'))#es; my $devpath_u = a2u($devpath); my $hash = hash_w7($devpath_u); if ($cmdline ne ''&&$origpath =~ /(rundll32|dllhost|mmc|svchost)\.exe/i) { $hash = ( $hash + hash_w7(a2u($origpath.' '.$cmdline)) ) % 4294967296; } return "$desc\t".sprintf("$filename-%08lX.pf",$hash)."\t$origpath\t$cmdline\t$devpath\n"; } sub calc_prefetch_2k8 { my $origpath = shift; my $cmdline = shift; my $desc = shift; die "\"$cmdline\" is not prefixed with at least one blank character\n" if ($cmdline ne '' & $cmdline !~ /^\s/); my $devpath = uc($origpath); my ($filename) = $devpath =~ /([^\\\/]+?)$/; $devpath =~ s#^([C-Z]):\\#sprintf("\\DEVICE\\HARDDISKVOLUME%s\\",ord($1)-ord('B'))#es; my $devpath_u = a2u($devpath); my $hash = hash_w7($devpath_u); if ($cmdline ne ''&&$origpath =~ /(rundll32|dllhost|mmc|svchost)\.exe/i) { $hash = ( $hash + hash_w7(a2u($origpath.' '.$cmdline)) ) % 4294967296; } return "$desc\t".sprintf("$filename-%08lX.pf",$hash)."\t$origpath\t$cmdline\t$devpath\n"; } sub calc_prefetch_vista { my $origpath = shift; my $cmdline = shift; my $desc = shift; die "\"$cmdline\" is not prefixed with at least one blank character\n" if ($cmdline ne '' & $cmdline !~ /^\s/); my $devpath = uc($origpath); my ($filename) = $devpath =~ /([^\\\/]+?)$/; $devpath =~ s#^([C-Z]):\\#sprintf("\\DEVICE\\HARDDISKVOLUME%s\\",ord($1)-ord('B'))#es; my $devpath_u = a2u($devpath); my $hash = hash_vista($devpath_u); if ($cmdline ne ''&&$origpath =~ /(rundll32|mmc)\.exe/i) { $hash = ( $hash + hash_vista(a2u('"'.$origpath.'"'.$cmdline)) ) % 4294967296; } return "$desc\t".sprintf("$filename-%08lX.pf",$hash)."\t$origpath\t$cmdline\t$devpath\n"; } sub calc_prefetch_xp { my $origpath = shift; my $cmdline = shift; my $desc = shift; die "\"$cmdline\" is not prefixed with at least one blank character\n" if ($cmdline ne '' & $cmdline !~ /^\s/); my $devpath = uc($origpath); my ($filename) = $devpath =~ /([^\\\/]+?)$/; $devpath =~ s#^([C-Z]):\\#sprintf("\\DEVICE\\HARDDISKVOLUME%s\\",ord($1)-ord('B'))#es; my $devpath_u = a2u($devpath); my $hash = hash_xp($devpath_u); if ($cmdline ne ''&&$origpath =~ /(rundll32|mmc)\.exe/i) { $hash = ( $hash + hash_xp(a2u('"'.$origpath.'"'.$cmdline)) ) % 4294967296; } return "$desc\t".sprintf("$filename-%08lX.pf",$hash)."\t$origpath\t$cmdline\t$devpath\n"; } sub calc_prefetch_2k3 { my $origpath = shift; my $cmdline = shift; my $desc = shift; die "\"$cmdline\" is not prefixed with at least one blank character\n" if ($cmdline ne '' & $cmdline !~ /^\s/); my $devpath = uc($origpath); my ($filename) = $devpath =~ /([^\\\/]+?)$/; $devpath =~ s#^([C-Z]):\\#sprintf("\\DEVICE\\HARDDISKVOLUME%s\\",ord($1)-ord('B'))#es; my $devpath_u = a2u($devpath); my $hash = hash_xp($devpath_u); if ($cmdline ne ''&&$origpath =~ /(rundll32|dllhost|mmc|svchost)\.exe/i) { $hash = ( $hash + hash_xp(a2u($origpath.$cmdline)) ) % 4294967296; } return "$desc\t".sprintf("$filename-%08lX.pf",$hash)."\t$origpath\t$cmdline\t$devpath\n"; } # 2003 - DLLHOST.EXE,MMC.EXE,RUNDLL32.EXE # hash same as XP #HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters #HostingAppList #RootDirPath sub hash_xp { my $devpath_u = shift; my $hash = 0; for (my $i=0; $i0x80000000); $hash = (abs($hash) % 1000000007) % 4294967296; return $hash; } sub hash_vista { my $devpath_u = shift; my $hash = 314159; for (my $i=0; $i) { s/[\r\n]+//; next if /^\s*$/; my @r=split(/\|/); next if !defined($r[0]); $r[1]='' if !defined($r[1]); $r[2]='' if !defined($r[2]); for (my $driven=ord('C'); $driven<=ord('F'); $driven++) { my $drive = chr($driven); print STDOUT calc_prefetch_xp ($drive.':'.$r[0],$r[1],'XP (32-bit)'.$r[2]); print STDOUT calc_prefetch_vista ($drive.':'.$r[0],$r[1],'Vista (32-bit)'.$r[2]); print STDOUT calc_prefetch_w7 ($drive.':'.$r[0],$r[1],'W7 (32-bit)'.$r[2]); print STDOUT calc_prefetch_2k3 ($drive.':'.$r[0],$r[1],'2003 (32-bit)'.$r[2]); print STDOUT calc_prefetch_2k8 ($drive.':'.$r[0],$r[1],'2008 (32-bit)'.$r[2]); print STDOUT calc_prefetch_w7_64 ($drive.':'.$r[0],$r[1],'W7 (64-bit)'.$r[2]); next if $r[2] eq ''; print STDOUT calc_prefetch_xp (uc($drive).':'.$r[0],uc($r[1]),'XP (32-bit)'.$r[2]); print STDOUT calc_prefetch_vista (uc($drive).':'.$r[0],uc($r[1]),'Vista (32-bit)'.$r[2]); print STDOUT calc_prefetch_w7 (uc($drive).':'.$r[0],uc($r[1]),'W7 (32-bit)'.$r[2]); print STDOUT calc_prefetch_2k3 (uc($drive).':'.$r[0],uc($r[1]),'2003 (32-bit)'.$r[2]); print STDOUT calc_prefetch_2k8 (uc($drive).':'.$r[0],uc($r[1]),'2008 (32-bit)'.$r[2]); print STDOUT calc_prefetch_w7_64 (uc($drive).':'.$r[0],uc($r[1]),'W7 (64-bit)'.$r[2]); print STDOUT calc_prefetch_xp (lc($drive).':'.$r[0],lc($r[1]),'XP (32-bit)'.$r[2]); print STDOUT calc_prefetch_vista (lc($drive).':'.$r[0],lc($r[1]),'Vista (32-bit)'.$r[2]); print STDOUT calc_prefetch_w7 (lc($drive).':'.$r[0],lc($r[1]),'W7 (32-bit)'.$r[2]); print STDOUT calc_prefetch_2k3 (lc($drive).':'.$r[0],lc($r[1]),'2003 (32-bit)'.$r[2]); print STDOUT calc_prefetch_2k8 (lc($drive).':'.$r[0],lc($r[1]),'2008 (32-bit)'.$r[2]); print STDOUT calc_prefetch_w7_64 (lc($drive).':'.$r[0],lc($r[1]),'W7 (64-bit)'.$r[2]); } } } __DATA__ \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL main.cpl @0|Mouse Properties \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL wscui.cpl|Action Center \WINDOWS\system32\rundll32.exe| shwebsvc.dll,AddNetPlaceRunDll|Add Network Location \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL appwiz.cpl|Add/Remove Programs \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL appwiz.cpl,,0|Add/Remove Programs \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL appwiz.cpl,,2|Add/Remove Windows Components \WINDOWS\system32\rundll32.exe| DwmApi #104|Aero (Transparency feature) Off \WINDOWS\system32\rundll32.exe| DwmApi #102|Aero (Transparency feature) On \WINDOWS\system32\rundll32.exe| msrating.dll,RatingSetupUI|Content Advisor \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL|Control Panel \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL timedate.cpl|Date and Time \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL timedate.cpl,,1|Date and Time (Additional Clocks) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL timedate.cpl|Date and Time (Properties) \WINDOWS\system32\rundll32.exe| devmgr.dll DeviceManager_Execute|Device Manager \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL hdwwiz.cpl|Device Manager \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL access.cpl,,3|Display Settings \WINDOWS\system32\rundll32.exe| shell32.dll,Options_RunDLL 0|Folder Options \WINDOWS\system32\rundll32.exe| shell32.dll,Control_Options 2|Folder Options (File Types) \WINDOWS\system32\rundll32.exe| shell32.dll,Options_RunDLL 2|Folder Options (Search) \WINDOWS\system32\rundll32.exe| shell32.dll,Options_RunDLL 7|Folder Options (View) \WINDOWS\system32\rundll32.exe| keymgr.dll,PRShowSaveWizardExW|Forgotten Password Wizard \WINDOWS\system32\rundll32.exe| powrprof.dll,SetSuspendState|Hibernate \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL main.cpl @1|Keyboard Properties \WINDOWS\system32\rundll32.exe| user32.dll,LockWorkStation|Lock Screen \WINDOWS\system32\rundll32.exe| shell32.dll,SHHelpShortcuts_RunDLL Connect|Map Network Drive \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL main.cpl @0|Mouse Properties \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL ncpa.cpl|Network Connections \WINDOWS\system32\rundll32.exe| shell32.dll,Options_RunDLL 5|Notification Cache \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL tabletpc.cpl|Pen and Touch Tablet PC (Settings) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL tabletpc.cpl,,1|Pen and Touch Tablet PC (Settings Flicks Tab) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL tabletpc.cpl,,2|Pen and Touch Tablet PC (Settings Handwriting Tab) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL collab.cpl|People Near Me \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL collab.cpl,,1|People Near Me (Sign Up Tab) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL desk.cpl,,2|Personalization \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL telephon.cpl|Phone and Modem (Options) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL telephon.cpl,,1|Phone and Modem (Options Modems Tab) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL telephon.cpl,,2|Phone and Modems (Options Advanced Tab) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL powercfg.cpl|Power Options \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL powercfg.cpl,,1|Power Options Modify Plan Settings \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL intl.cpl,,3|Regional Settings \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL desk.cpl|Screen Resolution \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL desk.cpl,,1|ScreenSaver \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL appwiz.cpl,,3|Set Program Access and Computer Defaults \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLLmmsys.cpl|Sound Control Playback Tab \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLLmmsys.cpl,,1|Sound Control Recording Tab \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLLmmsys.cpl,,2|Sound Control Sounds Tab \WINDOWS\system32\rundll32.exe| keymgr.dll,KRShowKeyMgr|Stored Usernames /Passwords \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL sysdm.cpl|System Properties \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL sysdm.cpl,,3|System Properties (Advanced Tab) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL sysdm.cpl,,2|System Properties (Hardware Tab) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL sysdm.cpl,,5|System Properties (Remote Tab) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL sysdm.cpl,,4|System Properties (System Protection Tab) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL sysdm.cpl,,4|System Properties (Advanced) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL sysdm.cpl,,5|System Properties (Automatic Updates) \WINDOWS\system32\rundll32.exe| shell32.dll,Options_RunDLL 1|Taskbar Properties \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL hotplug.dll|Unplug Eject Hardware \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL nusrmgr.cpl|User Accounts \WINDOWS\system32\rundll32.exe| oobefldr.dll,ShowWelcomeCenter|Welcome Center \WINDOWS\system32\rundll32.exe| SHELL32.DLL,ShellAboutW|Windows (About) \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL firewall.cpl|Windows Firewall \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL firewall.cpl|Windows Firewall \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL wscui.cpl|Windows Security Center \WINDOWS\system32\rundll32.exe| shell32.dll,Control_RunDLL NetSetup.cpl,@0,WNSW|Wireless Network Setup \WINDOWS\system32\rundll32.exe| van.dll,RunVAN|Wireless Networks pop-up \WINDOWS\system32\rundll32.exe| InetCpl.cpl,ClearMyTracksByProcess 4351|Delete All (Deeper Cleaning Including Add-on Data Deletion) \WINDOWS\system32\rundll32.exe| InetCpl.cpl,ClearMyTracksByProcess 255|Delete All \WINDOWS\system32\rundll32.exe| InetCpl.cpl,ClearMyTracksByProcess 2|Delete Cookies \WINDOWS\system32\rundll32.exe| InetCpl.cpl,ClearMyTracksByProcess 16|Delete Form Data \WINDOWS\system32\rundll32.exe| InetCpl.cpl,ClearMyTracksByProcess 1|Delete History \WINDOWS\system32\rundll32.exe| InetCpl.cpl,ClearMyTracksByProcess 32|Delete Passwords \WINDOWS\system32\rundll32.exe| InetCpl.cpl,ClearMyTracksByProcess 8|Delete Temporary Internet Files \windows\bfsvc.exe \windows\bitlockerdiscoveryvolumecontents\bitlockertogo.exe \windows\boot\pcat\memtest.exe \windows\digitallocker\digitalx.exe \windows\ehome\createdisc\sbeserver.exe \windows\ehome\ehexthost.exe \windows\ehome\ehmsas.exe \windows\ehome\ehprivjob.exe \windows\ehome\ehrec.exe \windows\ehome\ehrecvr.exe \windows\ehome\ehsched.exe \windows\ehome\ehshell.exe \windows\ehome\ehtray.exe \windows\ehome\ehvid.exe \windows\ehome\loadmxf.exe \windows\ehome\mcglidhost.exe \windows\ehome\mcrmgr.exe \windows\ehome\mcspad.exe \windows\ehome\mcupdate.exe \windows\ehome\mcx2prov.exe \windows\ehome\mcxtask.exe \windows\ehome\mediacenterweblauncher.exe \windows\ehome\registermceapp.exe \windows\ehome\wtvconverter.exe \windows\explorer.exe \windows\fveupdate.exe \windows\help\tablet pc\pentraining.exe \windows\help\tablet pc\touchtraining.exe \windows\help\tours\mmtour\tour.exe \windows\helppane.exe \windows\hh.exe \windows\inf\unregmp2.exe \windows\msagent\agentsvr.exe \windows\mui\muisetup.exe \windows\network diagnostic\xpnetdiag.exe \windows\notepad.exe \windows\panther\setup.exe \windows\pchealth\helpctr\binaries\helpctr.exe \windows\pchealth\helpctr\binaries\helphost.exe \windows\pchealth\helpctr\binaries\helpsvc.exe \windows\pchealth\helpctr\binaries\hscupd.exe \windows\pchealth\helpctr\binaries\msconfig.exe \windows\pchealth\helpctr\binaries\notiflag.exe \windows\pchealth\uploadlb\binaries\uploadm.exe \windows\regedit.exe \windows\servicing\gc32\tzupd.exe \windows\servicing\trustedinstaller.exe \windows\servicing\vsp1ceip.exe \windows\setup\scripts\bie7_inst.exe \windows\setup\scripts\bie7_uninst.exe \windows\setup\scripts\data\bootinst.exe \windows\setup\scripts\data\editioncheck.exe \windows\speech\common\sapisvr.exe \windows\system32\accwiz.exe \windows\system32\actmovie.exe \windows\system32\acw.exe \windows\system32\adaptertroubleshooter.exe \windows\system32\ahui.exe \windows\system32\aitagent.exe \windows\system32\alg.exe \windows\system32\append.exe \windows\system32\appidcertstorecheck.exe \windows\system32\appidpolicyconverter.exe \windows\system32\arp.exe \windows\system32\asr_fmt.exe \windows\system32\asr_ldm.exe \windows\system32\asr_pfu.exe \windows\system32\at.exe \windows\system32\atbroker.exe \windows\system32\atmadm.exe \windows\system32\attrib.exe \windows\system32\audiodg.exe \windows\system32\auditpol.exe \windows\system32\auditusr.exe \windows\system32\autochk.exe \windows\system32\autoconv.exe \windows\system32\autofmt.exe \windows\system32\autolfn.exe \windows\system32\axinstui.exe \windows\system32\baaupdate.exe \windows\system32\bcdboot.exe \windows\system32\bcdedit.exe \windows\system32\bdehdcfg.exe \windows\system32\bdeuisrv.exe \windows\system32\bdeunlockwizard.exe \windows\system32\bitlockerwizard.exe \windows\system32\bitlockerwizardelev.exe \windows\system32\bitsadmin.exe \windows\system32\blastcln.exe \windows\system32\boot\winload.exe \windows\system32\boot\winresume.exe \windows\system32\bootcfg.exe \windows\system32\bootok.exe \windows\system32\bootvrfy.exe \windows\system32\bridgeunattend.exe \windows\system32\bthudtask.exe \windows\system32\cacls.exe \windows\system32\calc.exe \windows\system32\cbsra.exe \windows\system32\certenrollctrl.exe \windows\system32\certreq.exe \windows\system32\certutil.exe \windows\system32\change.exe \windows\system32\charmap.exe \windows\system32\chglogon.exe \windows\system32\chgport.exe \windows\system32\chgusr.exe \windows\system32\chkdsk.exe \windows\system32\chkntfs.exe \windows\system32\choice.exe \windows\system32\cidaemon.exe \windows\system32\cipher.exe \windows\system32\cisvc.exe \windows\system32\ckcnv.exe \windows\system32\cleanmgr.exe \windows\system32\cliconfg.exe \windows\system32\clip.exe \windows\system32\clipbrd.exe \windows\system32\clipsrv.exe \windows\system32\cmd.exe \windows\system32\cmdkey.exe \windows\system32\cmdl32.exe \windows\system32\cmmon32.exe \windows\system32\cmstp.exe \windows\system32\cofire.exe \windows\system32\colorcpl.exe \windows\system32\com\comrepl.exe \windows\system32\com\comrereg.exe \windows\system32\com\migregdb.exe \windows\system32\comp.exe \windows\system32\compact.exe \windows\system32\compmgmtlauncher.exe \windows\system32\computerdefaults.exe \windows\system32\conhost.exe \windows\system32\conime.exe \windows\system32\consent.exe \windows\system32\control.exe \windows\system32\convert.exe \windows\system32\credwiz.exe \windows\system32\cscript.exe \windows\system32\csrss.exe \windows\system32\csrstub.exe \windows\system32\ctfmon.exe \windows\system32\cttune.exe \windows\system32\cttunesvr.exe \windows\system32\dccw.exe \windows\system32\dcomcnfg.exe \windows\system32\ddeshare.exe \windows\system32\ddodiag.exe \windows\system32\debug.exe \windows\system32\defrag.exe \windows\system32\devicedisplayobjectprovider.exe \windows\system32\deviceeject.exe \windows\system32\devicepairingwizard.exe \windows\system32\deviceproperties.exe \windows\system32\dfdwiz.exe \windows\system32\dfrgfat.exe \windows\system32\dfrgifc.exe \windows\system32\dfrgntfs.exe \windows\system32\dfrgui.exe \windows\system32\dfsr.exe \windows\system32\dialer.exe \windows\system32\diantz.exe \windows\system32\dinotify.exe \windows\system32\diskpart.exe \windows\system32\diskperf.exe \windows\system32\diskraid.exe \windows\system32\dism.exe \windows\system32\dism\dismhost.exe \windows\system32\dispdiag.exe \windows\system32\displayswitch.exe \windows\system32\djoin.exe \windows\system32\dllcache\accwiz.exe \windows\system32\dllcache\actmovie.exe \windows\system32\dllcache\admin.exe \windows\system32\dllcache\agentsvr.exe \windows\system32\dllcache\ahui.exe \windows\system32\dllcache\alg.exe \windows\system32\dllcache\append.exe \windows\system32\dllcache\arp.exe \windows\system32\dllcache\asr_fmt.exe \windows\system32\dllcache\asr_ldm.exe \windows\system32\dllcache\asr_pfu.exe \windows\system32\dllcache\at.exe \windows\system32\dllcache\atmadm.exe \windows\system32\dllcache\attrib.exe \windows\system32\dllcache\auditusr.exe \windows\system32\dllcache\author.exe \windows\system32\dllcache\autochk.exe \windows\system32\dllcache\autoconv.exe \windows\system32\dllcache\autofmt.exe \windows\system32\dllcache\autolfn.exe \windows\system32\dllcache\bckgzm.exe \windows\system32\dllcache\blastcln.exe \windows\system32\dllcache\bootcfg.exe \windows\system32\dllcache\bootok.exe \windows\system32\dllcache\bootvrfy.exe \windows\system32\dllcache\cacls.exe \windows\system32\dllcache\calc.exe \windows\system32\dllcache\cb32.exe \windows\system32\dllcache\cfgwiz.exe \windows\system32\dllcache\change.exe \windows\system32\dllcache\charmap.exe \windows\system32\dllcache\chglogon.exe \windows\system32\dllcache\chgport.exe \windows\system32\dllcache\chgusr.exe \windows\system32\dllcache\chkdsk.exe \windows\system32\dllcache\chkntfs.exe \windows\system32\dllcache\chkrzm.exe \windows\system32\dllcache\cidaemon.exe \windows\system32\dllcache\cintsetp.exe \windows\system32\dllcache\cipher.exe \windows\system32\dllcache\cisvc.exe \windows\system32\dllcache\ckcnv.exe \windows\system32\dllcache\cleanmgr.exe \windows\system32\dllcache\clipbrd.exe \windows\system32\dllcache\clipsrv.exe \windows\system32\dllcache\cmd.exe \windows\system32\dllcache\cmdl32.exe \windows\system32\dllcache\cmmon32.exe \windows\system32\dllcache\cmstp.exe \windows\system32\dllcache\comp.exe \windows\system32\dllcache\compact.exe \windows\system32\dllcache\comrepl.exe \windows\system32\dllcache\comrereg.exe \windows\system32\dllcache\conf.exe \windows\system32\dllcache\conime.exe \windows\system32\dllcache\control.exe \windows\system32\dllcache\convert.exe \windows\system32\dllcache\convlog.exe \windows\system32\dllcache\cplexe.exe \windows\system32\dllcache\cprofile.exe \windows\system32\dllcache\cscript.exe \windows\system32\dllcache\csrss.exe \windows\system32\dllcache\ctfmon.exe \windows\system32\dllcache\davcdata.exe \windows\system32\dllcache\dcomcnfg.exe \windows\system32\dllcache\ddeshare.exe \windows\system32\dllcache\debug.exe \windows\system32\dllcache\defrag.exe \windows\system32\dllcache\dfrgfat.exe \windows\system32\dllcache\dfrgntfs.exe \windows\system32\dllcache\dialer.exe \windows\system32\dllcache\diantz.exe \windows\system32\dllcache\diskpart.exe \windows\system32\dllcache\diskperf.exe \windows\system32\dllcache\dllhost.exe \windows\system32\dllcache\dllhst3g.exe \windows\system32\dllcache\dmadmin.exe \windows\system32\dllcache\dmremote.exe \windows\system32\dllcache\doskey.exe \windows\system32\dllcache\dosx.exe \windows\system32\dllcache\dplaysvr.exe \windows\system32\dllcache\dpnsvr.exe \windows\system32\dllcache\dpvsetup.exe \windows\system32\dllcache\drvqry.exe \windows\system32\dllcache\drwatson.exe \windows\system32\dllcache\drwtsn32.exe \windows\system32\dllcache\dumprep.exe \windows\system32\dllcache\dvdupgrd.exe \windows\system32\dllcache\dwwin.exe \windows\system32\dllcache\dxdiag.exe \windows\system32\dllcache\edlin.exe \windows\system32\dllcache\esentutl.exe \windows\system32\dllcache\eudcedit.exe \windows\system32\dllcache\evcreate.exe \windows\system32\dllcache\eventvwr.exe \windows\system32\dllcache\evntcmd.exe \windows\system32\dllcache\evntwin.exe \windows\system32\dllcache\evtrig.exe \windows\system32\dllcache\exch_regtrace.exe \windows\system32\dllcache\exe2bin.exe \windows\system32\dllcache\expand.exe \windows\system32\dllcache\explorer.exe \windows\system32\dllcache\extrac32.exe \windows\system32\dllcache\fastopen.exe \windows\system32\dllcache\fc.exe \windows\system32\dllcache\find.exe \windows\system32\dllcache\findstr.exe \windows\system32\dllcache\finger.exe \windows\system32\dllcache\fixmapi.exe \windows\system32\dllcache\flattemp.exe \windows\system32\dllcache\fltmc.exe \windows\system32\dllcache\fontview.exe \windows\system32\dllcache\forcedos.exe \windows\system32\dllcache\fp98sadm.exe \windows\system32\dllcache\fp98swin.exe \windows\system32\dllcache\fpadmcgi.exe \windows\system32\dllcache\fpcount.exe \windows\system32\dllcache\fpremadm.exe \windows\system32\dllcache\freecell.exe \windows\system32\dllcache\fsutil.exe \windows\system32\dllcache\ftp.exe \windows\system32\dllcache\fxsclnt.exe \windows\system32\dllcache\fxscover.exe \windows\system32\dllcache\fxssend.exe \windows\system32\dllcache\fxssvc.exe \windows\system32\dllcache\gdi.exe \windows\system32\dllcache\getmac.exe \windows\system32\dllcache\gprslt.exe \windows\system32\dllcache\gpupdate.exe \windows\system32\dllcache\grpconv.exe \windows\system32\dllcache\help.exe \windows\system32\dllcache\helpctr.exe \windows\system32\dllcache\helphost.exe \windows\system32\dllcache\helpsvc.exe \windows\system32\dllcache\hh.exe \windows\system32\dllcache\hostname.exe \windows\system32\dllcache\hrtzzm.exe \windows\system32\dllcache\hscupd.exe \windows\system32\dllcache\icwconn1.exe \windows\system32\dllcache\icwconn2.exe \windows\system32\dllcache\icwrmind.exe \windows\system32\dllcache\icwtutor.exe \windows\system32\dllcache\ie4uinit.exe \windows\system32\dllcache\iedw.exe \windows\system32\dllcache\iexplore.exe \windows\system32\dllcache\iexpress.exe \windows\system32\dllcache\iisreset.exe \windows\system32\dllcache\iisrstas.exe \windows\system32\dllcache\iissync.exe \windows\system32\dllcache\imapi.exe \windows\system32\dllcache\imekrmig.exe \windows\system32\dllcache\imepadsv.exe \windows\system32\dllcache\imjpdadm.exe \windows\system32\dllcache\imjpdct.exe \windows\system32\dllcache\imjpdsvr.exe \windows\system32\dllcache\imjpinst.exe \windows\system32\dllcache\imjpmig.exe \windows\system32\dllcache\imjprw.exe \windows\system32\dllcache\imjpuex.exe \windows\system32\dllcache\imjputy.exe \windows\system32\dllcache\imkrinst.exe \windows\system32\dllcache\imscinst.exe \windows\system32\dllcache\inetin51.exe \windows\system32\dllcache\inetmgr.exe \windows\system32\dllcache\inetwiz.exe \windows\system32\dllcache\ipconfig.exe \windows\system32\dllcache\ipsec6.exe \windows\system32\dllcache\ipv6.exe \windows\system32\dllcache\ipxroute.exe \windows\system32\dllcache\isignup.exe \windows\system32\dllcache\krnl386.exe \windows\system32\dllcache\label.exe \windows\system32\dllcache\lhmstsc.exe \windows\system32\dllcache\lights.exe \windows\system32\dllcache\lnkstub.exe \windows\system32\dllcache\locator.exe \windows\system32\dllcache\lodctr.exe \windows\system32\dllcache\logagent.exe \windows\system32\dllcache\logman.exe \windows\system32\dllcache\logoff.exe \windows\system32\dllcache\logonui.exe \windows\system32\dllcache\lpq.exe \windows\system32\dllcache\lpr.exe \windows\system32\dllcache\lsass.exe \windows\system32\dllcache\magnify.exe \windows\system32\dllcache\makecab.exe \windows\system32\dllcache\mem.exe \windows\system32\dllcache\migisol.exe \windows\system32\dllcache\migload.exe \windows\system32\dllcache\migrate.exe \windows\system32\dllcache\migregdb.exe \windows\system32\dllcache\migwiz.exe \windows\system32\dllcache\migwiza.exe \windows\system32\dllcache\mmc.exe \windows\system32\dllcache\mmcperf.exe \windows\system32\dllcache\mnmsrvc.exe \windows\system32\dllcache\mobsync.exe \windows\system32\dllcache\mofcomp.exe \windows\system32\dllcache\mountvol.exe \windows\system32\dllcache\moviemk.exe \windows\system32\dllcache\mplay32.exe \windows\system32\dllcache\mplayer2.exe \windows\system32\dllcache\mpnotify.exe \windows\system32\dllcache\mqbkup.exe \windows\system32\dllcache\mqsvc.exe \windows\system32\dllcache\mqtgsvc.exe \windows\system32\dllcache\mrinfo.exe \windows\system32\dllcache\mscdexnt.exe \windows\system32\dllcache\msconfig.exe \windows\system32\dllcache\msdtc.exe \windows\system32\dllcache\msg.exe \windows\system32\dllcache\mshearts.exe \windows\system32\dllcache\mshta.exe \windows\system32\dllcache\msiexec.exe \windows\system32\dllcache\msimn.exe \windows\system32\dllcache\msinfo32.exe \windows\system32\dllcache\msiregmv.exe \windows\system32\dllcache\msoobe.exe \windows\system32\dllcache\mspaint.exe \windows\system32\dllcache\msswchx.exe \windows\system32\dllcache\mstinit.exe \windows\system32\dllcache\mtstocom.exe \windows\system32\dllcache\muisetup.exe \windows\system32\dllcache\napstat.exe \windows\system32\dllcache\narrator.exe \windows\system32\dllcache\nbtstat.exe \windows\system32\dllcache\nddeapir.exe \windows\system32\dllcache\net.exe \windows\system32\dllcache\net1.exe \windows\system32\dllcache\netdde.exe \windows\system32\dllcache\netsetup.exe \windows\system32\dllcache\netsh.exe \windows\system32\dllcache\netstat.exe \windows\system32\dllcache\nlsfunc.exe \windows\system32\dllcache\notepad.exe \windows\system32\dllcache\notiflag.exe \windows\system32\dllcache\nppagent.exe \windows\system32\dllcache\nslookup.exe \windows\system32\dllcache\ntbackup.exe \windows\system32\dllcache\ntsd.exe \windows\system32\dllcache\ntvdm.exe \windows\system32\dllcache\nw16.exe \windows\system32\dllcache\nwscript.exe \windows\system32\dllcache\odbcad32.exe \windows\system32\dllcache\odbcconf.exe \windows\system32\dllcache\oemig50.exe \windows\system32\dllcache\oobebaln.exe \windows\system32\dllcache\opnfiles.exe \windows\system32\dllcache\osk.exe \windows\system32\dllcache\osuninst.exe \windows\system32\dllcache\packager.exe \windows\system32\dllcache\pathping.exe \windows\system32\dllcache\pentnt.exe \windows\system32\dllcache\perfmon.exe \windows\system32\dllcache\pinball.exe \windows\system32\dllcache\ping.exe \windows\system32\dllcache\ping6.exe \windows\system32\dllcache\pintlphr.exe \windows\system32\dllcache\powercfg.exe \windows\system32\dllcache\print.exe \windows\system32\dllcache\progman.exe \windows\system32\dllcache\proquota.exe \windows\system32\dllcache\proxycfg.exe \windows\system32\dllcache\qappsrv.exe \windows\system32\dllcache\qprocess.exe \windows\system32\dllcache\query.exe \windows\system32\dllcache\quser.exe \windows\system32\dllcache\qwinsta.exe \windows\system32\dllcache\rasautou.exe \windows\system32\dllcache\rasdial.exe \windows\system32\dllcache\rasphone.exe \windows\system32\dllcache\rcimlby.exe \windows\system32\dllcache\rcp.exe \windows\system32\dllcache\rdpclip.exe \windows\system32\dllcache\rdsaddin.exe \windows\system32\dllcache\rdshost.exe \windows\system32\dllcache\recover.exe \windows\system32\dllcache\redir.exe \windows\system32\dllcache\reg.exe \windows\system32\dllcache\regedit.exe \windows\system32\dllcache\regedt32.exe \windows\system32\dllcache\regini.exe \windows\system32\dllcache\register.exe \windows\system32\dllcache\regsvr32.exe \windows\system32\dllcache\regwiz.exe \windows\system32\dllcache\relog.exe \windows\system32\dllcache\replace.exe \windows\system32\dllcache\reset.exe \windows\system32\dllcache\rexec.exe \windows\system32\dllcache\route.exe \windows\system32\dllcache\routemon.exe \windows\system32\dllcache\rsh.exe \windows\system32\dllcache\rsm.exe \windows\system32\dllcache\rsmsink.exe \windows\system32\dllcache\rsmui.exe \windows\system32\dllcache\rsnotify.exe \windows\system32\dllcache\rsopprov.exe \windows\system32\dllcache\rstrui.exe \windows\system32\dllcache\rsvp.exe \windows\system32\dllcache\rtcshare.exe \windows\system32\dllcache\runas.exe \windows\system32\dllcache\rundll32.exe \windows\system32\dllcache\runonce.exe \windows\system32\dllcache\rvsezm.exe \windows\system32\dllcache\rwinsta.exe \windows\system32\dllcache\sapisvr.exe \windows\system32\dllcache\savedump.exe \windows\system32\dllcache\sc.exe \windows\system32\dllcache\scardsvr.exe \windows\system32\dllcache\scrcons.exe \windows\system32\dllcache\sctasks.exe \windows\system32\dllcache\sdbinst.exe \windows\system32\dllcache\secedit.exe \windows\system32\dllcache\services.exe \windows\system32\dllcache\sessmgr.exe \windows\system32\dllcache\sethc.exe \windows\system32\dllcache\setup.exe \windows\system32\dllcache\setup50.exe \windows\system32\dllcache\setup_wm.exe \windows\system32\dllcache\setupn.exe \windows\system32\dllcache\sfc.exe \windows\system32\dllcache\shadow.exe \windows\system32\dllcache\share.exe \windows\system32\dllcache\shmgrate.exe \windows\system32\dllcache\shrpubw.exe \windows\system32\dllcache\shtml.exe \windows\system32\dllcache\shutdown.exe \windows\system32\dllcache\shvlzm.exe \windows\system32\dllcache\sigverif.exe \windows\system32\dllcache\skeys.exe \windows\system32\dllcache\smbinst.exe \windows\system32\dllcache\smi2smir.exe \windows\system32\dllcache\smlogsvc.exe \windows\system32\dllcache\smss.exe \windows\system32\dllcache\sndrec32.exe \windows\system32\dllcache\sndvol32.exe \windows\system32\dllcache\snmp.exe \windows\system32\dllcache\snmptrap.exe \windows\system32\dllcache\sol.exe \windows\system32\dllcache\sort.exe \windows\system32\dllcache\spider.exe \windows\system32\dllcache\spiisupd.exe \windows\system32\dllcache\spnpinst.exe \windows\system32\dllcache\spoolsv.exe \windows\system32\dllcache\sprestrt.exe \windows\system32\dllcache\srdiag.exe \windows\system32\dllcache\stimon.exe \windows\system32\dllcache\subst.exe \windows\system32\dllcache\svchost.exe \windows\system32\dllcache\syncapp.exe \windows\system32\dllcache\sysedit.exe \windows\system32\dllcache\sysinfo.exe \windows\system32\dllcache\syskey.exe \windows\system32\dllcache\sysocmgr.exe \windows\system32\dllcache\systray.exe \windows\system32\dllcache\taskkill.exe \windows\system32\dllcache\tasklist.exe \windows\system32\dllcache\taskman.exe \windows\system32\dllcache\taskmgr.exe \windows\system32\dllcache\tcmsetup.exe \windows\system32\dllcache\tcpsvcs.exe \windows\system32\dllcache\tcptest.exe \windows\system32\dllcache\telnet.exe \windows\system32\dllcache\tftp.exe \windows\system32\dllcache\tintlphr.exe \windows\system32\dllcache\tintsetp.exe \windows\system32\dllcache\tlntadmn.exe \windows\system32\dllcache\tlntsess.exe \windows\system32\dllcache\tlntsvr.exe \windows\system32\dllcache\tourstrt.exe \windows\system32\dllcache\tourw.exe \windows\system32\dllcache\tracerpt.exe \windows\system32\dllcache\tracert.exe \windows\system32\dllcache\tracert6.exe \windows\system32\dllcache\tscon.exe \windows\system32\dllcache\tsdiscon.exe \windows\system32\dllcache\tskill.exe \windows\system32\dllcache\tsprof.exe \windows\system32\dllcache\tsshutdn.exe \windows\system32\dllcache\twunk_16.exe \windows\system32\dllcache\twunk_32.exe \windows\system32\dllcache\typeperf.exe \windows\system32\dllcache\unlodctr.exe \windows\system32\dllcache\unregmp2.exe \windows\system32\dllcache\unsecapp.exe \windows\system32\dllcache\uploadm.exe \windows\system32\dllcache\upnpcont.exe \windows\system32\dllcache\ups.exe \windows\system32\dllcache\user.exe \windows\system32\dllcache\userinit.exe \windows\system32\dllcache\utilman.exe \windows\system32\dllcache\verifier.exe \windows\system32\dllcache\vssadmin.exe \windows\system32\dllcache\vssvc.exe \windows\system32\dllcache\vwipxspx.exe \windows\system32\dllcache\w32tm.exe \windows\system32\dllcache\wab.exe \windows\system32\dllcache\wabmig.exe \windows\system32\dllcache\wb32.exe \windows\system32\dllcache\wbemtest.exe \windows\system32\dllcache\wextract.exe \windows\system32\dllcache\wiaacmgr.exe \windows\system32\dllcache\winchat.exe \windows\system32\dllcache\winhelp.exe \windows\system32\dllcache\winhlp32.exe \windows\system32\dllcache\winhstb.exe \windows\system32\dllcache\winlogon.exe \windows\system32\dllcache\winmgmt.exe \windows\system32\dllcache\winmine.exe \windows\system32\dllcache\winmsd.exe \windows\system32\dllcache\winspool.exe \windows\system32\dllcache\winver.exe \windows\system32\dllcache\wmiadap.exe \windows\system32\dllcache\wmiapsrv.exe \windows\system32\dllcache\wmic.exe \windows\system32\dllcache\wmiprvse.exe \windows\system32\dllcache\wmplayer.exe \windows\system32\dllcache\wordpad.exe \windows\system32\dllcache\wowdeb.exe \windows\system32\dllcache\wowexec.exe \windows\system32\dllcache\wpabaln.exe \windows\system32\dllcache\wpnpinst.exe \windows\system32\dllcache\write.exe \windows\system32\dllcache\wscntfy.exe \windows\system32\dllcache\wscript.exe \windows\system32\dllcache\wuauclt.exe \windows\system32\dllcache\wuauclt1.exe \windows\system32\dllcache\wupdmgr.exe \windows\system32\dllcache\xcopy.exe \windows\system32\dllcache\zclientm.exe \windows\system32\dllhost.exe \windows\system32\dllhst3g.exe \windows\system32\dmadmin.exe \windows\system32\dmremote.exe \windows\system32\dnscacheugc.exe \windows\system32\doskey.exe \windows\system32\dosx.exe \windows\system32\dpapimig.exe \windows\system32\dpiscaling.exe \windows\system32\dplaysvr.exe \windows\system32\dpnsvr.exe \windows\system32\dpvsetup.exe \windows\system32\driverquery.exe \windows\system32\drvinst.exe \windows\system32\drwatson.exe \windows\system32\drwtsn32.exe \windows\system32\dumprep.exe \windows\system32\dvdplay.exe \windows\system32\dvdupgrd.exe \windows\system32\dwm.exe \windows\system32\dwwin.exe \windows\system32\dxdiag.exe \windows\system32\dxpserver.exe \windows\system32\eap3host.exe \windows\system32\edlin.exe \windows\system32\efsui.exe \windows\system32\ehstorauthn.exe \windows\system32\esentutl.exe \windows\system32\eudcedit.exe \windows\system32\eventcreate.exe \windows\system32\eventtriggers.exe \windows\system32\eventvwr.exe \windows\system32\exe2bin.exe \windows\system32\expand.exe \windows\system32\extrac32.exe \windows\system32\fastopen.exe \windows\system32\fc.exe \windows\system32\find.exe \windows\system32\findstr.exe \windows\system32\finger.exe \windows\system32\firewallcontrolpanel.exe \windows\system32\firewallsettings.exe \windows\system32\fixmapi.exe \windows\system32\fltmc.exe \windows\system32\fontview.exe \windows\system32\forcedos.exe \windows\system32\forfiles.exe \windows\system32\freecell.exe \windows\system32\fsquirt.exe \windows\system32\fsutil.exe \windows\system32\ftp.exe \windows\system32\fvenotify.exe \windows\system32\fveprompt.exe \windows\system32\fxscover.exe \windows\system32\fxssvc.exe \windows\system32\fxsunatd.exe \windows\system32\gdi.exe \windows\system32\getmac.exe \windows\system32\gettingstarted.exe \windows\system32\gpresult.exe \windows\system32\gpscript.exe \windows\system32\gpupdate.exe \windows\system32\grpconv.exe \windows\system32\hdwwiz.exe \windows\system32\help.exe \windows\system32\hostname.exe \windows\system32\hwrcomp.exe \windows\system32\hwrreg.exe \windows\system32\iashost.exe \windows\system32\icacls.exe \windows\system32\icardagt.exe \windows\system32\icsunattend.exe \windows\system32\ie4uinit.exe \windows\system32\ieunatt.exe \windows\system32\iexpress.exe \windows\system32\imapi.exe \windows\system32\ime\imejp10\imjpdadm.exe \windows\system32\ime\imejp10\imjpdct.exe \windows\system32\ime\imejp10\imjpdsvr.exe \windows\system32\ime\imejp10\imjpmgr.exe \windows\system32\ime\imejp10\imjppdmg.exe \windows\system32\ime\imejp10\imjpuex.exe \windows\system32\ime\imejp10\imjpuexc.exe \windows\system32\ime\imesc5\imscprop.exe \windows\system32\ime\imetc10\imtcprop.exe \windows\system32\ime\shared\imccphr.exe \windows\system32\ime\shared\imepadsv.exe \windows\system32\infdefaultinstall.exe \windows\system32\ipconfig.exe \windows\system32\ipsec6.exe \windows\system32\ipv6.exe \windows\system32\ipxroute.exe \windows\system32\irftp.exe \windows\system32\iscsicli.exe \windows\system32\iscsicpl.exe \windows\system32\isoburn.exe \windows\system32\klist.exe \windows\system32\krnl386.exe \windows\system32\ksetup.exe \windows\system32\ktmutil.exe \windows\system32\label.exe \windows\system32\lights.exe \windows\system32\lnkstub.exe \windows\system32\locationnotifications.exe \windows\system32\locator.exe \windows\system32\lodctr.exe \windows\system32\logagent.exe \windows\system32\logman.exe \windows\system32\logoff.exe \windows\system32\logonui.exe \windows\system32\lpksetup.exe \windows\system32\lpq.exe \windows\system32\lpr.exe \windows\system32\lpremove.exe \windows\system32\lsass.exe \windows\system32\lsm.exe \windows\system32\magnify.exe \windows\system32\makecab.exe \windows\system32\manage-bde.exe \windows\system32\mblctr.exe \windows\system32\mcbuilder.exe \windows\system32\mctadmin.exe \windows\system32\mdres.exe \windows\system32\mdsched.exe \windows\system32\mem.exe \windows\system32\mfpmp.exe \windows\system32\migautoplay.exe \windows\system32\migpwd.exe \windows\system32\migwiz\mighost.exe \windows\system32\migwiz\migsetup.exe \windows\system32\migwiz\migwiz.exe \windows\system32\migwiz\postmig.exe \windows\system32\mmc.exe \windows\system32\mmcperf.exe \windows\system32\mnmsrvc.exe \windows\system32\mobsync.exe \windows\system32\mountvol.exe \windows\system32\mplay32.exe \windows\system32\mpnotify.exe \windows\system32\mqbkup.exe \windows\system32\mqsvc.exe \windows\system32\mqtgsvc.exe \windows\system32\mrinfo.exe \windows\system32\mrt.exe \windows\system32\mscdexnt.exe \windows\system32\msconfig.exe \windows\system32\msdt.exe \windows\system32\msdtc.exe \windows\system32\msfeedssync.exe \windows\system32\msg.exe \windows\system32\mshearts.exe \windows\system32\mshta.exe \windows\system32\msiexec.exe \windows\system32\msinfo32.exe \windows\system32\mspaint.exe \windows\system32\msra.exe \windows\system32\msswchx.exe \windows\system32\mstinit.exe \windows\system32\mstsc.exe \windows\system32\mtstocom.exe \windows\system32\muiunattend.exe \windows\system32\multidigimon.exe \windows\system32\napstat.exe \windows\system32\narrator.exe \windows\system32\nbtstat.exe \windows\system32\ndadmin.exe \windows\system32\nddeapir.exe \windows\system32\net.exe \windows\system32\net1.exe \windows\system32\netbtugc.exe \windows\system32\netcfg.exe \windows\system32\netdde.exe \windows\system32\netiougc.exe \windows\system32\netplwiz.exe \windows\system32\netproj.exe \windows\system32\netsetup.exe \windows\system32\netsh.exe \windows\system32\netstat.exe \windows\system32\newdev.exe \windows\system32\nlsfunc.exe \windows\system32\nltest.exe \windows\system32\notepad.exe \windows\system32\npp\nppagent.exe \windows\system32\nslookup.exe \windows\system32\ntbackup.exe \windows\system32\ntkrnlpa.exe \windows\system32\ntoskrnl.exe \windows\system32\ntprint.exe \windows\system32\ntsd.exe \windows\system32\ntvdm.exe \windows\system32\nw16.exe \windows\system32\nwscript.exe \windows\system32\ocsetup.exe \windows\system32\odbcad32.exe \windows\system32\odbcconf.exe \windows\system32\oobe\audit.exe \windows\system32\oobe\msoobe.exe \windows\system32\oobe\oobebaln.exe \windows\system32\oobe\oobeldr.exe \windows\system32\oobe\setup.exe \windows\system32\oobe\setupsqm.exe \windows\system32\oobe\windeploy.exe \windows\system32\openfiles.exe \windows\system32\optionalfeatures.exe \windows\system32\osk.exe \windows\system32\osuninst.exe \windows\system32\p2phost.exe \windows\system32\packager.exe \windows\system32\pathping.exe \windows\system32\pcaelv.exe \windows\system32\pcalua.exe \windows\system32\pcaui.exe \windows\system32\pcawrk.exe \windows\system32\pcwrun.exe \windows\system32\pentnt.exe \windows\system32\perfmon.exe \windows\system32\ping.exe \windows\system32\ping6.exe \windows\system32\pkgmgr.exe \windows\system32\plasrv.exe \windows\system32\pnpunattend.exe \windows\system32\pnputil.exe \windows\system32\poqexec.exe \windows\system32\powercfg.exe \windows\system32\presentationhost.exe \windows\system32\presentationsettings.exe \windows\system32\prevhost.exe \windows\system32\print.exe \windows\system32\printbrmui.exe \windows\system32\printfilterpipelinesvc.exe \windows\system32\printisolationhost.exe \windows\system32\printui.exe \windows\system32\progman.exe \windows\system32\proquota.exe \windows\system32\proxycfg.exe \windows\system32\psr.exe \windows\system32\pushprinterconnections.exe \windows\system32\qappsrv.exe \windows\system32\qprocess.exe \windows\system32\query.exe \windows\system32\quser.exe \windows\system32\qwinsta.exe \windows\system32\racagent.exe \windows\system32\rasautou.exe \windows\system32\rasdial.exe \windows\system32\raserver.exe \windows\system32\rasphone.exe \windows\system32\rcimlby.exe \windows\system32\rcp.exe \windows\system32\rdpclip.exe \windows\system32\rdpinit.exe \windows\system32\rdpshell.exe \windows\system32\rdpsign.exe \windows\system32\rdrleakdiag.exe \windows\system32\rdsaddin.exe \windows\system32\rdshost.exe \windows\system32\reagentc.exe \windows\system32\recdisc.exe \windows\system32\recover.exe \windows\system32\redir.exe \windows\system32\reg.exe \windows\system32\regedt32.exe \windows\system32\regini.exe \windows\system32\registeriepkeys.exe \windows\system32\regsvr32.exe \windows\system32\regwiz.exe \windows\system32\rekeywiz.exe \windows\system32\relog.exe \windows\system32\relpost.exe \windows\system32\repair-bde.exe \windows\system32\replace.exe \windows\system32\reset.exe \windows\system32\resmon.exe \windows\system32\restore\rstrui.exe \windows\system32\restore\srdiag.exe \windows\system32\rexec.exe \windows\system32\rmactivate.exe \windows\system32\rmactivate_isv.exe \windows\system32\rmactivate_ssp.exe \windows\system32\rmactivate_ssp_isv.exe \windows\system32\rmclient.exe \windows\system32\robocopy.exe \windows\system32\route.exe \windows\system32\routemon.exe \windows\system32\rpcping.exe \windows\system32\rrinstaller.exe \windows\system32\rsh.exe \windows\system32\rsm.exe \windows\system32\rsmsink.exe \windows\system32\rsmui.exe \windows\system32\rsnotify.exe \windows\system32\rsopprov.exe \windows\system32\rstrui.exe \windows\system32\rsvp.exe \windows\system32\rtcshare.exe \windows\system32\runas.exe \windows\system32\rundll32.exe \windows\system32\runlegacycplelevated.exe \windows\system32\runonce.exe \windows\system32\rwinsta.exe \windows\system32\savedump.exe \windows\system32\sbunattend.exe \windows\system32\sc.exe \windows\system32\scardsvr.exe \windows\system32\schtasks.exe \windows\system32\sdbinst.exe \windows\system32\sdchange.exe \windows\system32\sdclt.exe \windows\system32\sdiagnhost.exe \windows\system32\searchfilterhost.exe \windows\system32\searchindexer.exe \windows\system32\searchprotocolhost.exe \windows\system32\secedit.exe \windows\system32\secinit.exe \windows\system32\services.exe \windows\system32\sessmgr.exe \windows\system32\sethc.exe \windows\system32\setieinstalleddate.exe \windows\system32\setspn.exe \windows\system32\setup.exe \windows\system32\setupcl.exe \windows\system32\setupn.exe \windows\system32\setupsnk.exe \windows\system32\setupugc.exe \windows\system32\setver.exe \windows\system32\setx.exe \windows\system32\sfc.exe \windows\system32\shadow.exe \windows\system32\share.exe \windows\system32\shmgrate.exe \windows\system32\shrpubw.exe \windows\system32\shutdown.exe \windows\system32\sigverif.exe \windows\system32\skeys.exe \windows\system32\sllua.exe \windows\system32\slsvc.exe \windows\system32\slui.exe \windows\system32\smbinst.exe \windows\system32\smlogsvc.exe \windows\system32\smss.exe \windows\system32\sndrec32.exe \windows\system32\sndvol.exe \windows\system32\sndvol32.exe \windows\system32\snippingtool.exe \windows\system32\snmptrap.exe \windows\system32\sol.exe \windows\system32\sort.exe \windows\system32\soundrecorder.exe \windows\system32\speech\speechux\speechuxtutorial.exe \windows\system32\speech\speechux\speechuxwiz.exe \windows\system32\spider.exe \windows\system32\spiisupd.exe \windows\system32\spinstall.exe \windows\system32\spnpinst.exe \windows\system32\spool\tools\printbrm.exe \windows\system32\spool\tools\printbrmengine.exe \windows\system32\spoolsv.exe \windows\system32\sppsvc.exe \windows\system32\sprestrt.exe \windows\system32\spreview.exe \windows\system32\srdelayed.exe \windows\system32\stikynot.exe \windows\system32\stimon.exe \windows\system32\subst.exe \windows\system32\svchost.exe \windows\system32\sxstrace.exe \windows\system32\syncapp.exe \windows\system32\synchost.exe \windows\system32\sysedit.exe \windows\system32\syskey.exe \windows\system32\sysocmgr.exe \windows\system32\sysprep\sysprep.exe \windows\system32\systeminfo.exe \windows\system32\systempropertiesadvanced.exe \windows\system32\systempropertiescomputername.exe \windows\system32\systempropertiesdataexecutionprevention.exe \windows\system32\systempropertieshardware.exe \windows\system32\systempropertiesperformance.exe \windows\system32\systempropertiesprotection.exe \windows\system32\systempropertiesremote.exe \windows\system32\systray.exe \windows\system32\tabcal.exe \windows\system32\takeown.exe \windows\system32\tapiunattend.exe \windows\system32\taskeng.exe \windows\system32\taskhost.exe \windows\system32\taskkill.exe \windows\system32\tasklist.exe \windows\system32\taskman.exe \windows\system32\taskmgr.exe \windows\system32\tcmsetup.exe \windows\system32\tcpsvcs.exe \windows\system32\telnet.exe \windows\system32\tftp.exe \windows\system32\timeout.exe \windows\system32\tlntadmn.exe \windows\system32\tlntsess.exe \windows\system32\tlntsvr.exe \windows\system32\tourstart.exe \windows\system32\tpminit.exe \windows\system32\tracerpt.exe \windows\system32\tracert.exe \windows\system32\tracert6.exe \windows\system32\tscon.exe \windows\system32\tscupgrd.exe \windows\system32\tsdiscon.exe \windows\system32\tskill.exe \windows\system32\tsshutdn.exe \windows\system32\tstheme.exe \windows\system32\tswbprxy.exe \windows\system32\tswpfwrp.exe \windows\system32\typeperf.exe \windows\system32\tzchange.exe \windows\system32\tzutil.exe \windows\system32\ucsvc.exe \windows\system32\ui0detect.exe \windows\system32\unattendedjoin.exe \windows\system32\unlodctr.exe \windows\system32\unregmp2.exe \windows\system32\upnpcont.exe \windows\system32\ups.exe \windows\system32\user.exe \windows\system32\useraccountcontrolsettings.exe \windows\system32\userinit.exe \windows\system32\usmt\migload.exe \windows\system32\usmt\migwiz.exe \windows\system32\usmt\migwiza.exe \windows\system32\usrmlnka.exe \windows\system32\usrprbda.exe \windows\system32\usrshuta.exe \windows\system32\utilman.exe \windows\system32\vaultcmd.exe \windows\system32\vaultsysui.exe \windows\system32\vds.exe \windows\system32\vdsldr.exe \windows\system32\verclsid.exe \windows\system32\verifier.exe \windows\system32\vmicsvc.exe \windows\system32\vsp1cln.exe \windows\system32\vssadmin.exe \windows\system32\vssvc.exe \windows\system32\vwipxspx.exe \windows\system32\w32tm.exe \windows\system32\waitfor.exe \windows\system32\wbadmin.exe \windows\system32\wbem\mofcomp.exe \windows\system32\wbem\scrcons.exe \windows\system32\wbem\unsecapp.exe \windows\system32\wbem\wbemtest.exe \windows\system32\wbem\winmgmt.exe \windows\system32\wbem\wmiadap.exe \windows\system32\wbem\wmiapsrv.exe \windows\system32\wbem\wmic.exe \windows\system32\wbem\wmiprvse.exe \windows\system32\wbengine.exe \windows\system32\wecutil.exe \windows\system32\wercon.exe \windows\system32\werfault.exe \windows\system32\werfaultsecure.exe \windows\system32\wermgr.exe \windows\system32\wevtutil.exe \windows\system32\wextract.exe \windows\system32\wfs.exe \windows\system32\where.exe \windows\system32\whoami.exe \windows\system32\wiaacmgr.exe \windows\system32\wimserv.exe \windows\system32\winchat.exe \windows\system32\windowsanytimeupgraderesults.exe \windows\system32\windowspowershell\v1.0\powershell.exe \windows\system32\windowspowershell\v1.0\powershell_ise.exe \windows\system32\winfxdocobj.exe \windows\system32\winhlp32.exe \windows\system32\wininit.exe \windows\system32\winload.exe \windows\system32\winlogon.exe \windows\system32\winmine.exe \windows\system32\winmsd.exe \windows\system32\winresume.exe \windows\system32\winrs.exe \windows\system32\winrshost.exe \windows\system32\winsat.exe \windows\system32\winspool.exe \windows\system32\winver.exe \windows\system32\wisptis.exe \windows\system32\wksprt.exe \windows\system32\wlanext.exe \windows\system32\wlrmdr.exe \windows\system32\wowdeb.exe \windows\system32\wowexec.exe \windows\system32\wpabaln.exe \windows\system32\wpcer.exe \windows\system32\wpcumi.exe \windows\system32\wpdshextautoplay.exe \windows\system32\wpnpinst.exe \windows\system32\write.exe \windows\system32\wscntfy.exe \windows\system32\wscript.exe \windows\system32\wsmanhttpconfig.exe \windows\system32\wsmprovhost.exe \windows\system32\wsqmcons.exe \windows\system32\wuapp.exe \windows\system32\wuauclt.exe \windows\system32\wuauclt1.exe \windows\system32\wudfhost.exe \windows\system32\wupdmgr.exe \windows\system32\wusa.exe \windows\system32\xcopy.exe \windows\system32\xpsrchvw.exe \windows\system32\xpsviewer\xpsviewer.exe \windows\system32\xwizard.exe \windows\taskman.exe \windows\temp\rarsfx0\bootinst_w7ldr.exe \windows\temp\rarsfx0\md5.exe \windows\twunk_16.exe \windows\twunk_32.exe \windows\winhelp.exe \windows\winhlp32.exe \windows\write.exe