Loading dump 1.
Parsing dump 1.
Loading dump 2.
Parsing dump 2.
Comparing the two dumps.
Comparsion result:
CRE HKEY_CLASSES_ROOT\AppID\WStart.DLL
CRE HKEY_CLASSES_ROOT\AppID\WStart.DLL\AppID
CRE HKEY_CLASSES_ROOT\AppID\XPlugin.DLL
CRE HKEY_CLASSES_ROOT\AppID\XPlugin.DLL\AppID
CRE HKEY_CLASSES_ROOT\AppID\{AC3F36D4-F905-4FE9-A926-EB937E66F591}
CRE HKEY_CLASSES_ROOT\AppID\{AC3F36D4-F905-4FE9-A926-EB937E66F591}\
CRE HKEY_CLASSES_ROOT\AppID\{F6BDB4E5-D6AA-4D1F-8B67-BCB0F2246E21}
CRE HKEY_CLASSES_ROOT\AppID\{F6BDB4E5-D6AA-4D1F-8B67-BCB0F2246E21}\
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\AppID
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\InprocServer32
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\InprocServer32\
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\InprocServer32\ThreadingModel
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\ProgID
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\ProgID\
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\TypeLib
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\TypeLib\
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\VersionIndependentProgID
CRE HKEY_CLASSES_ROOT\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\VersionIndependentProgID\
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\AppID
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\InprocServer32
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\InprocServer32\
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\InprocServer32\ThreadingModel
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\ProgID
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\ProgID\
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\TypeLib
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\TypeLib\
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\VersionIndependentProgID
CRE HKEY_CLASSES_ROOT\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\VersionIndependentProgID\
CRE HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html
CRE HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html\
CRE HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html\CLSID
CRE HKEY_CLASSES_ROOT\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}
CRE HKEY_CLASSES_ROOT\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0
CRE HKEY_CLASSES_ROOT\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\
CRE HKEY_CLASSES_ROOT\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\0
CRE HKEY_CLASSES_ROOT\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\0\win32
CRE HKEY_CLASSES_ROOT\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\0\win32\
CRE HKEY_CLASSES_ROOT\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\FLAGS
CRE HKEY_CLASSES_ROOT\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\FLAGS\
CRE HKEY_CLASSES_ROOT\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\HELPDIR
CRE HKEY_CLASSES_ROOT\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\HELPDIR\
CRE HKEY_CLASSES_ROOT\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}
CRE HKEY_CLASSES_ROOT\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0
CRE HKEY_CLASSES_ROOT\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\
CRE HKEY_CLASSES_ROOT\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\0
CRE HKEY_CLASSES_ROOT\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\0\win32
CRE HKEY_CLASSES_ROOT\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\0\win32\
CRE HKEY_CLASSES_ROOT\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\FLAGS
CRE HKEY_CLASSES_ROOT\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\FLAGS\
CRE HKEY_CLASSES_ROOT\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\HELPDIR
CRE HKEY_CLASSES_ROOT\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\HELPDIR\
CRE HKEY_CLASSES_ROOT\WStart.WHttpHelper
CRE HKEY_CLASSES_ROOT\WStart.WHttpHelper.1
CRE HKEY_CLASSES_ROOT\WStart.WHttpHelper.1\
CRE HKEY_CLASSES_ROOT\WStart.WHttpHelper.1\CLSID
CRE HKEY_CLASSES_ROOT\WStart.WHttpHelper.1\CLSID\
CRE HKEY_CLASSES_ROOT\WStart.WHttpHelper\
CRE HKEY_CLASSES_ROOT\WStart.WHttpHelper\CLSID
CRE HKEY_CLASSES_ROOT\WStart.WHttpHelper\CLSID\
CRE HKEY_CLASSES_ROOT\WStart.WHttpHelper\CurVer
CRE HKEY_CLASSES_ROOT\WStart.WHttpHelper\CurVer\
CRE HKEY_CLASSES_ROOT\XPlugin.XFilter
CRE HKEY_CLASSES_ROOT\XPlugin.XFilter.1
CRE HKEY_CLASSES_ROOT\XPlugin.XFilter.1\
CRE HKEY_CLASSES_ROOT\XPlugin.XFilter.1\CLSID
CRE HKEY_CLASSES_ROOT\XPlugin.XFilter.1\CLSID\
CRE HKEY_CLASSES_ROOT\XPlugin.XFilter\
CRE HKEY_CLASSES_ROOT\XPlugin.XFilter\CLSID
CRE HKEY_CLASSES_ROOT\XPlugin.XFilter\CLSID\
CRE HKEY_CLASSES_ROOT\XPlugin.XFilter\CurVer
CRE HKEY_CLASSES_ROOT\XPlugin.XFilter\CurVer\
CRE HKEY_CURRENT_USER\Printers\DevModePerUser
CRE HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar
CRE HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SetHP
CRE HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Custom Search URL
CRE HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst
CRE HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\hpnt
CRE HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ucsID
CRE HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs\url7
CRE HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs\url8
CRE HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPublisher
CRE HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs
CRE HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs
CRE HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU\b
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU\c
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\MRUList
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\a
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\b
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\c
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\d
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\e
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\f
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\g
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\h
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\i
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\j
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithList
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithList\MRUList
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithList\a
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithList\b
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithProgids
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithProgids\txtfile
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\0
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\1
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\2
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\3
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\4
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\5
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\6
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\7
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\8
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\9
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\MRUListEx
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\10
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\11
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\12
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\13
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\14
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\15
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\5
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\6
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\7
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\8
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\9
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\3
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\HRZR_HVGBBYONE:0k1,125
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:Traiät gvyy UvwnpxGuvf.rkr.yax
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHAPCY:"P:\JVAQBJF\Flfgrz32\nccjvm.pcy",Yätt gvyy ryyre gn obeg cebtenz
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_HVFPHG
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\link
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\0\1
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\0\1\MRUListEx
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\0\1\NodeSlot
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\2
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\2\MRUListEx
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\2\NodeSlot
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0\0
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0\0\MRUListEx
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0\0\NodeSlot
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0\MRUListEx
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0\NodeSlot
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\MRUListEx
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\MRUListEx
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\MRUListEx
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Address
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Buttons
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Col
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\ColInfo
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\FFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\HotKey
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Links
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\MaxPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\MaxPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\MinPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\MinPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Mode
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Rev
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\ScrollPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\ScrollPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\ShowCmd
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Sort
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\SortDir
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Status
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Vid
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\WFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\WinPos800x600(1).bottom
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\WinPos800x600(1).left
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\WinPos800x600(1).right
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\WinPos800x600(1).top
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Address
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Buttons
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Col
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\ColInfo
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\FFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\HotKey
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Links
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\MaxPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\MaxPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\MinPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\MinPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Mode
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Rev
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\ScrollPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\ScrollPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\ShowCmd
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Sort
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\SortDir
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Status
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Vid
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\WFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\WinPos800x600(1).bottom
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\WinPos800x600(1).left
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\WinPos800x600(1).right
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\WinPos800x600(1).top
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Address
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Buttons
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Col
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\ColInfo
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\FFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\FolderType
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\HotKey
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Links
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\MaxPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\MaxPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\MinPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\MinPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Mode
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Rev
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\ScrollPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\ScrollPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\ShowCmd
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Sort
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\SortDir
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Status
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Vid
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\WFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\WinPos800x600(1).bottom
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\WinPos800x600(1).left
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\WinPos800x600(1).right
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\WinPos800x600(1).top
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Address
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Buttons
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Col
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\ColInfo
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\FFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\HotKey
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Links
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\MaxPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\MaxPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\MinPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\MinPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Mode
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Rev
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\ScrollPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\ScrollPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\ShowCmd
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Sort
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\SortDir
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Status
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Vid
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\WFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\WinPos800x600(1).bottom
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\WinPos800x600(1).left
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\WinPos800x600(1).right
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\WinPos800x600(1).top
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Address
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Buttons
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Col
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\ColInfo
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\FFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\HotKey
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Links
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\MaxPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\MaxPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\MinPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\MinPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Mode
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Rev
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\ScrollPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\ScrollPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\ShowCmd
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Sort
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\SortDir
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Status
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Vid
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\WFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\WinPos800x600(1).bottom
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\WinPos800x600(1).left
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\WinPos800x600(1).right
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\WinPos800x600(1).top
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\Address
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\Buttons
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\FFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\HotKey
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\Links
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\MaxPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\MaxPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\MinPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\MinPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\Rev
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\ShowCmd
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\Status
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\WFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\WinPos800x600(1).bottom
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\WinPos800x600(1).left
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\WinPos800x600(1).right
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\WinPos800x600(1).top
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\4
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\4\Shell
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\4\Shell\FolderType
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Address
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Buttons
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Col
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\ColInfo
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\FFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\FolderType
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\HotKey
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Links
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\MaxPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\MaxPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\MinPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\MinPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Mode
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Rev
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\ScrollPos800x600(1).x
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\ScrollPos800x600(1).y
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\ShowCmd
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Sort
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\SortDir
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Status
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Vid
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\WFlags
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\WinPos800x600(1).bottom
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\WinPos800x600(1).left
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\WinPos800x600(1).right
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\WinPos800x600(1).top
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\DUIBags\ShellFolders\{46E06680-4BF0-11D1-83EE-00A0C90DC849}
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\DUIBags\ShellFolders\{46E06680-4BF0-11D1-83EE-00A0C90DC849}\ExpandDetailsTasks
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\DUIBags\ShellFolders\{C0542A90-4BF0-11D1-83EE-00A0C90DC849}
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\DUIBags\ShellFolders\{C0542A90-4BF0-11D1-83EE-00A0C90DC849}\ExpandDetailsTasks
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-12696
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22923
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@sendmail.dll,-21
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@sendmail.dll,-4
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-12589
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-12590
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31343
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31345
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31347
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31349
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31351
CRE HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@zipfldr.dll,-10148
CRE HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher
CRE HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs
CRE HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs
CRE HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\WStart.DLL
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\WStart.DLL\AppID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\XPlugin.DLL
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\XPlugin.DLL\AppID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AC3F36D4-F905-4FE9-A926-EB937E66F591}
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AC3F36D4-F905-4FE9-A926-EB937E66F591}\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{F6BDB4E5-D6AA-4D1F-8B67-BCB0F2246E21}
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{F6BDB4E5-D6AA-4D1F-8B67-BCB0F2246E21}\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\AppID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\InprocServer32
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\InprocServer32\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\InprocServer32\ThreadingModel
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\ProgID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\ProgID\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\TypeLib
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\TypeLib\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\VersionIndependentProgID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\VersionIndependentProgID\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\AppID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\InprocServer32
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\InprocServer32\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\InprocServer32\ThreadingModel
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\ProgID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\ProgID\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\TypeLib
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\TypeLib\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\VersionIndependentProgID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9896231A-C487-43A5-8369-6EC9B0A96CC0}\VersionIndependentProgID\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html\CLSID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\0
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\0\win32
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\0\win32\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\FLAGS
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\FLAGS\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\HELPDIR
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7}\1.0\HELPDIR\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\0
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\0\win32
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\0\win32\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\FLAGS
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\FLAGS\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\HELPDIR
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\HELPDIR\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper.1
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper.1\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper.1\CLSID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper.1\CLSID\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper\CLSID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper\CLSID\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper\CurVer
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WStart.WHttpHelper\CurVer\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XPlugin.XFilter
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XPlugin.XFilter.1
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XPlugin.XFilter.1\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XPlugin.XFilter.1\CLSID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XPlugin.XFilter.1\CLSID\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XPlugin.XFilter\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XPlugin.XFilter\CLSID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XPlugin.XFilter\CLSID\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XPlugin.XFilter\CurVer
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XPlugin.XFilter\CurVer\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{14A3221B-1678-1982-A355-7263B1281987}
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{14A3221B-1678-1982-A355-7263B1281987}\Contains
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{14A3221B-1678-1982-A355-7263B1281987}\DownloadInformation
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{14A3221B-1678-1982-A355-7263B1281987}\DownloadInformation\CODEBASE
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{14A3221B-1678-1982-A355-7263B1281987}\InstalledVersion
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{14A3221B-1678-1982-A355-7263B1281987}\InstalledVersion\
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{14A3221B-1678-1982-A355-7263B1281987}\Installer
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{14A3221B-1678-1982-A355-7263B1281987}\SystemComponent
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DownloadManager
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig\DEBUG
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig\DEBUG\Trace Level
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher\CRLs
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher\CTLs
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPublisher\Certificates
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CTLs
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\HijackThis
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\HijackThis\Changed
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\HijackThis\SlowInfoCache
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9896231A-C487-43A5-8369-6EC9B0A96CC0}
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tlc
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs
CRE HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\ID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\Last
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\LastUCS
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\Period
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\UID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\Version
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\erru
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\fid
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\hlid
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\seln
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\slid
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\tmpi
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\ulid
CRE HKEY_LOCAL_MACHINE\SOFTWARE\TMKSoft\XPlugin\upln
CRE HKEY_LOCAL_MACHINE\SOFTWARE\WSoft
CRE HKEY_LOCAL_MACHINE\SOFTWARE\WSoft\TCPService2
CRE HKEY_LOCAL_MACHINE\SOFTWARE\WSoft\TCPService2\ID
CRE HKEY_LOCAL_MACHINE\SOFTWARE\WSoft\TCPService2\Last
CRE HKEY_LOCAL_MACHINE\SOFTWARE\WSoft\TCPService2\Period
CRE HKEY_LOCAL_MACHINE\SOFTWARE\WSoft\TCPService2\Version
CRE HKEY_LOCAL_MACHINE\SOFTWARE\WSoft\TCPService2\erun
CRE HKEY_LOCAL_MACHINE\SOFTWARE\WSoft\TCPService2\srcid
CRE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\Shares\Security\shared
CRE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\Shares\shared
CRE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares\Security\shared
CRE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares\shared
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Printers\DevModePerUser
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\Main\Search Bar
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\Main\SetHP
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\Main\Use Custom Search URL
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\Main\Use Search Asst
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\Main\hpnt
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\Main\ucsID
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\TypedURLs\url7
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\TypedURLs\url8
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\SystemCertificates\TrustedPublisher
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows Script Host
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows Script Host\Settings
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU\b
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU\c
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\MRUList
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\a
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\b
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\c
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\d
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\e
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\f
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\g
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\h
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\i
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\j
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithList
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithList\MRUList
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithList\a
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithList\b
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithProgids
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithProgids\txtfile
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\0
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\1
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\2
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\3
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\4
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\5
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\6
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\7
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\8
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\9
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log\MRUListEx
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\10
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\11
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\12
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\13
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\14
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\15
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\5
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\6
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\7
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\8
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\9
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\3
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\HRZR_HVGBBYONE:0k1,125
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:Traiät gvyy UvwnpxGuvf.rkr.yax
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHAPCY:"P:\JVAQBJF\Flfgrz32\nccjvm.pcy",Yätt gvyy ryyre gn obeg cebtenz
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_HVFPHG
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\link
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\0\1
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\0\1\MRUListEx
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\0\1\NodeSlot
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\2
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\2\MRUListEx
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\2\NodeSlot
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0\0
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0\0\MRUListEx
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0\0\NodeSlot
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0\MRUListEx
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\0\NodeSlot
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\0\MRUListEx
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\0\MRUListEx
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\3\MRUListEx
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Address
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Buttons
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Col
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\ColInfo
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\FFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\HotKey
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Links
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\MaxPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\MaxPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\MinPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\MinPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Mode
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Rev
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\ScrollPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\ScrollPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\ShowCmd
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Sort
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\SortDir
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Status
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\Vid
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\WFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\WinPos800x600(1).bottom
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\WinPos800x600(1).left
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\WinPos800x600(1).right
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\10\Shell\WinPos800x600(1).top
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Address
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Buttons
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Col
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\ColInfo
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\FFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\HotKey
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Links
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\MaxPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\MaxPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\MinPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\MinPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Mode
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Rev
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\ScrollPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\ScrollPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\ShowCmd
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Sort
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\SortDir
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Status
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\Vid
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\WFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\WinPos800x600(1).bottom
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\WinPos800x600(1).left
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\WinPos800x600(1).right
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\11\Shell\WinPos800x600(1).top
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Address
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Buttons
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Col
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\ColInfo
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\FFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\FolderType
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\HotKey
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Links
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\MaxPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\MaxPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\MinPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\MinPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Mode
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Rev
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\ScrollPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\ScrollPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\ShowCmd
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Sort
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\SortDir
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Status
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\Vid
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\WFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\WinPos800x600(1).bottom
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\WinPos800x600(1).left
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\WinPos800x600(1).right
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\12\Shell\WinPos800x600(1).top
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Address
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Buttons
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Col
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\ColInfo
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\FFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\HotKey
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Links
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\MaxPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\MaxPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\MinPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\MinPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Mode
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Rev
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\ScrollPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\ScrollPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\ShowCmd
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Sort
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\SortDir
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Status
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\Vid
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\WFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\WinPos800x600(1).bottom
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\WinPos800x600(1).left
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\WinPos800x600(1).right
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\1\Shell\WinPos800x600(1).top
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Address
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Buttons
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Col
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\ColInfo
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\FFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\HotKey
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Links
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\MaxPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\MaxPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\MinPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\MinPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Mode
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Rev
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\ScrollPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\ScrollPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\ShowCmd
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Sort
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\SortDir
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Status
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\Vid
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\WFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\WinPos800x600(1).bottom
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\WinPos800x600(1).left
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\WinPos800x600(1).right
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell\WinPos800x600(1).top
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\Address
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\Buttons
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\FFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\HotKey
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\Links
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\MaxPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\MaxPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\MinPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\MinPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\Rev
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\ShowCmd
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\Status
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\WFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\WinPos800x600(1).bottom
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\WinPos800x600(1).left
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\WinPos800x600(1).right
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\3\Shell\WinPos800x600(1).top
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\4
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\4\Shell
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\4\Shell\FolderType
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Address
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Buttons
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Col
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\ColInfo
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\FFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\FolderType
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\HotKey
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Links
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\MaxPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\MaxPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\MinPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\MinPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Mode
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Rev
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\ScrollPos800x600(1).x
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\ScrollPos800x600(1).y
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\ShowCmd
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Sort
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\SortDir
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Status
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\Vid
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\WFlags
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\WinPos800x600(1).bottom
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\WinPos800x600(1).left
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\WinPos800x600(1).right
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\9\Shell\WinPos800x600(1).top
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\DUIBags\ShellFolders\{46E06680-4BF0-11D1-83EE-00A0C90DC849}
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\DUIBags\ShellFolders\{46E06680-4BF0-11D1-83EE-00A0C90DC849}\ExpandDetailsTasks
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\DUIBags\ShellFolders\{C0542A90-4BF0-11D1-83EE-00A0C90DC849}
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\DUIBags\ShellFolders\{C0542A90-4BF0-11D1-83EE-00A0C90DC849}\ExpandDetailsTasks
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-12696
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22923
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@sendmail.dll,-21
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@sendmail.dll,-4
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-12589
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-12590
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31343
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31345
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31347
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31349
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31351
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@zipfldr.dll,-10148
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs
CRE HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates
CRE c:\Documents and Settings\Roger\Application Data\Microsoft\HTML Help
CRE c:\Documents and Settings\Roger\Application Data\Microsoft\HTML Help\hh.dat
CRE c:\Documents and Settings\Roger\Cookies\roger@57995[1].txt
CRE c:\Documents and Settings\Roger\Cookies\roger@69.31.86[1].txt
CRE c:\Documents and Settings\Roger\Cookies\roger@82.179.170[2].txt
CRE c:\Documents and Settings\Roger\Cookies\roger@crackz[2].txt
CRE c:\Documents and Settings\Roger\Cookies\roger@sea.search.msn[1].txt
CRE c:\Documents and Settings\Roger\Cookies\roger@stat.onestat[2].txt
CRE c:\Documents and Settings\Roger\Cookies\roger@totsex[1].txt
CRE c:\Documents and Settings\Roger\Cookies\roger@us[1].txt
CRE c:\Documents and Settings\Roger\Cookies\roger@xxxtoolbar[1].txt
CRE c:\Documents and Settings\Roger\Cookies\roger@yadro[1].txt
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temp\~DF239D.tmp
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\1910718897[1].css
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\CA0XQJ09.php
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\CA14AXPZ.php
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\CA2062[1].jpg
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\CAO9ADXY.php
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\_popup1[1].js
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\b[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\b[2].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\bannerpool[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\c[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\c[2].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\chako_a0022[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\coUAprint[1].css
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\cracksearchws[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\e9xr2[1].chm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\flag_au[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\flag_cl[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\flag_de[2].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\flag_dk[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\flag_ee[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\flag_fi[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\flag_fr[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\flag_ir[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\flag_nz[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\flag_py[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\flag_sk[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\get.top[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\get.top[2].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\get.top[3].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\hpp3n[1].hta
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\l_lef[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\log_downloads[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\micro-gulli[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\pload[2].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\plus[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\setka2[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\spacer[3].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\spacer[4].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\top100[1].png
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\tri1[1].png
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\ucs5[1].dat
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\utils[1].js
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\wed_bluedragyingyang[1].jpg
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\wistat2[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ\xltmk[1].dat
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\031002_arc[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\040429_780027_DV[1].jpg
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\040504_DVDlabrador3[1].jpg
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\CA17Q9QH.HTM
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\CAH8CBTP.gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\G-Bee.v1.3_crack_serial_keygen[1].html
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\QuestForAlliance1[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\ThawtePremiumServerCA[1].crl
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\asta120x50[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\astams[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\b[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\b[2].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\b[3].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\beastys[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\c[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\coUA[1].css
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\crackzws[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\delux[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\dnserror[1].com
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\file[1].exe
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_ar[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_at[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_bo[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_br[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_ch[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_hk[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_hu[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_id[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_il[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_it[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_ma[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_ro[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_ru[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_se[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\flag_za[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\get.top[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\get.top[2].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\hdr35[1].js
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\js[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\my-search[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\search[1].png
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\spacer2[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\t_rig[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\task[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\topsitez[1].jpg
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\uc63_[1].jpg
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\update[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\031009_nounours[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\040115_hell[1].jpg
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\120x60-andrnet[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\1910718897[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\88logo[1].jpg
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\Argon3D1[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\CAKPYXU1.HTM
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\CAUFSP01.php
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\CAYJMRMT.php
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\Fulep_0496[1].jpg
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\GB_468x60_04[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\QuestForAlliance21[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\_popup2[1].js
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\astabar[1]
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\b[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\b[2].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\b[3].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\b[4].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\b_rig[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\button120[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\c[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\counter[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\d1[2].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_be[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_ca[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_gb[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_gr[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_lv[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_mx[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_pl[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_pt[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_sv[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_tw[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_ua[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\flag_ve[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\helppane26[1].js
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\iframe[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\index[2].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\msnDNSLogo[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\pix[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\prompt[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\prompt[1].php
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\s9[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\trans[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\tri2[1].png
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\wapmeet1_120[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV\wistat[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\040225_coeur[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\040406_dauphins[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\CAQJK12L.php
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\Driv3r1[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\SpeedAddict1[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\ThawteCodeSigningCA[1].crl
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\astabar[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\b[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\b[2].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\b[3].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\botton[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\crackz[2]
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\dl_rougeclair[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\dns-info[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\en-us_CSS_Classic[1].css
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\fff[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_by[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_cu[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_cz[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_es[2].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_jm[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_lt[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_lu[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_my[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_nl[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_no[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_pe[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_th[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\flag_us[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\g1[2].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\get.top[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\go[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\i[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\index[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\matrix[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\setka2[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\son_rougeclair[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\top100mob120x60ani[1].gif
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\totsex[1].htm
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\tri2[1].png
CRE c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB\wed_4purplecharm[1].jpg
CRE c:\Documents and Settings\Roger\Recent\hijackthis1.log.lnk
CRE c:\Documents and Settings\Roger\Recent\hijackthis10.log.lnk
CRE c:\Documents and Settings\Roger\Recent\hijackthis11.log.lnk
CRE c:\Documents and Settings\Roger\Recent\hijackthis2.log.lnk
CRE c:\Documents and Settings\Roger\Recent\hijackthis4.log.lnk
CRE c:\Documents and Settings\Roger\Recent\hijackthis5.log.lnk
CRE c:\Documents and Settings\Roger\Recent\hijackthis6.log.lnk
CRE c:\Documents and Settings\Roger\Recent\hijackthis7.log.lnk
CRE c:\Documents and Settings\Roger\Recent\hijackthis8.log.lnk
CRE c:\Documents and Settings\Roger\Recent\hijackthis9.log.lnk
CRE c:\Documents and Settings\Roger\Recent\logs.lnk
CRE c:\Documents and Settings\Roger\Skrivbord\Genväg till HijackThis.exe.lnk
CRE c:\RECYCLER\S-1-5-21-1229272821-413027322-839522115-1003\Dc10.log
CRE c:\RECYCLER\S-1-5-21-1229272821-413027322-839522115-1003\Dc6.dat
CRE c:\RECYCLER\S-1-5-21-1229272821-413027322-839522115-1003\Dc7.log
CRE c:\RECYCLER\S-1-5-21-1229272821-413027322-839522115-1003\Dc8.log
CRE c:\RECYCLER\S-1-5-21-1229272821-413027322-839522115-1003\Dc9
CRE c:\RECYCLER\S-1-5-21-1229272821-413027322-839522115-1003\Dc9\hijackthis1.log
CRE c:\WINDOWS\Prefetch\FILE.EXE-30A11DEA.pf
CRE c:\WINDOWS\Prefetch\IPCONFIG.EXE-2395F30B.pf
CRE c:\WINDOWS\Prefetch\RUNDLL32.EXE-27AF91C9.pf
CRE c:\WINDOWS\Prefetch\TCPSERVICE2.EXE-245BDD13.pf
CRE c:\WINDOWS\Prefetch\TKSRV99.EXE-0BF15508.pf
CRE c:\WINDOWS\Prefetch\TMKSRVU.EXE-27C06461.pf
CRE c:\WINDOWS\Prefetch\UCSI.EXE-32761829.pf
CRE c:\WINDOWS\Prefetch\UCSL.EXE-0DDDD95B.pf
CRE c:\WINDOWS\Prefetch\WSCRIPT.EXE-32960AB9.pf
CRE c:\WINDOWS\nsdb
CRE c:\WINDOWS\nsdb\hosts
CRE c:\WINDOWS\system32\TCPService2.exe
CRE c:\WINDOWS\system32\WStart.dll
CRE c:\WINDOWS\system32\tksrv99.exe
CRE c:\WINDOWS\system32\tmksrvu.exe
CRE c:\WINDOWS\system32\tmp3.txt
CRE c:\WINDOWS\system32\uc1362.exe
CRE c:\WINDOWS\system32\ucsi.exe
CRE c:\WINDOWS\system32\ucsl.exe
CRE c:\WINDOWS\system32\xplugin.dll
CRE c:\WINDOWS\update13.js
CRE c:\software\shared
CRE c:\software\shared\hijackthis1.log
CRE c:\software\shared\hijackthis10.log
CRE c:\software\shared\hijackthis11.log
CRE c:\software\shared\hijackthis2.log
CRE c:\software\shared\hijackthis4.log
CRE c:\software\shared\hijackthis5.log
CRE c:\software\shared\hijackthis6.log
CRE c:\software\shared\hijackthis7.log
CRE c:\software\shared\hijackthis8.log
CRE c:\software\shared\hijackthis9.log
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%SystemRoot%\inf\unregmp2.exe,-155
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%SystemRoot%\system32\xpsp1res.dll,-10078
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\Program\MSNGAM~1\Windows\bckgres.dll,-1212
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\Program\MSNGAM~1\Windows\chkrres.dll,-1212
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\Program\MSNGAM~1\Windows\hrtzres.dll,-1212
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\Program\MSNGAM~1\Windows\rvseres.dll,-1212
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\Program\MSNGAM~1\Windows\shvlres.dll,-1212
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\System32\comres.dll,-661
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\System32\mstsc.exe,-4000
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\ime\sptip.dll,-600
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-12695
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22912
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22981
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22982
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22985
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-32517
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\compatUI.dll,-115
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\hnetwiz.dll,-3085
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\mshearts.exe,-413
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\netshell.dll,-1010
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\netshell.dll,-1200
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\restore\rstrui.exe,-2048
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\spider.exe,-56
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\usmt\migwiz.exe,-202
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\wiashext.dll,-331
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7004
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7005
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7020
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7021
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7023
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-864
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-865
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-866
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-867
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-868
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-880
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-12691
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-12704
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-12705
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21760
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21762
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21768
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21772
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21779
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21788
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21790
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22016
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22017
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22018
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22019
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22021
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22022
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22023
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22025
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22026
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22027
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22029
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22030
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22031
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22040
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22041
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22045
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22051
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22052
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22054
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22055
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22057
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22058
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22059
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22060
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22061
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22062
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22063
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22065
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22066
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22067
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22069
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-28964
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30497
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30498
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30499
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30500
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30501
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30502
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30503
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30504
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30505
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30506
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30507
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30508
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30509
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30510
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30511
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30512
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30513
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30514
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30517
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30518
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31234
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31243
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31245
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31247
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31249
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31275
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31292
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31317
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31319
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31321
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31323
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31325
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2015
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2016
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2017
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2037
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2038
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2039
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2040
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2041
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2042
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@xpsp1res.dll,-11003
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@xpsp1res.dll,-11005
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@zipfldr.dll,-10300
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@zipfldr.dll,-10301
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@zipfldr.dll,-10302
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program\Internet Explorer\iexplore.exe
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program\Windows NT\Tillbehör\WORDPAD.EXE
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\Explorer.EXE
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\System32\logon.scr
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\System32\taskmgr.exe
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\System32\zipfldr.dll
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\notepad.exe
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\NOTEPAD.EXE
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\mshta.exe
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\software\HijackThis.exe
DEL HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%SystemRoot%\inf\unregmp2.exe,-155
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%SystemRoot%\system32\xpsp1res.dll,-10078
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\Program\MSNGAM~1\Windows\bckgres.dll,-1212
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\Program\MSNGAM~1\Windows\chkrres.dll,-1212
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\Program\MSNGAM~1\Windows\hrtzres.dll,-1212
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\Program\MSNGAM~1\Windows\rvseres.dll,-1212
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\Program\MSNGAM~1\Windows\shvlres.dll,-1212
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\System32\comres.dll,-661
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\System32\mstsc.exe,-4000
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\ime\sptip.dll,-600
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-12695
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22912
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22981
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22982
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22985
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-32517
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\compatUI.dll,-115
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\hnetwiz.dll,-3085
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\mshearts.exe,-413
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\netshell.dll,-1010
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\netshell.dll,-1200
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\restore\rstrui.exe,-2048
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\spider.exe,-56
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\usmt\migwiz.exe,-202
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\wiashext.dll,-331
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7004
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7005
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7020
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7021
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7023
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-864
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-865
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-866
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-867
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-868
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shdoclc.dll,-880
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-12691
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-12704
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-12705
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21760
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21762
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21768
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21772
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21779
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21788
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-21790
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22016
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22017
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22018
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22019
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22021
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22022
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22023
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22025
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22026
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22027
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22029
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22030
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22031
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22040
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22041
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22045
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22051
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22052
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22054
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22055
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22057
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22058
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22059
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22060
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22061
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22062
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22063
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22065
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22066
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22067
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-22069
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-28964
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30497
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30498
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30499
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30500
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30501
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30502
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30503
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30504
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30505
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30506
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30507
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30508
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30509
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30510
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30511
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30512
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30513
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30514
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30517
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-30518
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31234
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31243
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31245
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31247
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31249
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31275
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31292
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31317
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31319
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31321
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31323
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31325
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2015
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2016
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2017
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2037
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2038
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2039
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2040
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2041
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@themeui.dll,-2042
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@xpsp1res.dll,-11003
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@xpsp1res.dll,-11005
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@zipfldr.dll,-10300
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@zipfldr.dll,-10301
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\@zipfldr.dll,-10302
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program\Internet Explorer\iexplore.exe
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program\Windows NT\Tillbehör\WORDPAD.EXE
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\Explorer.EXE
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\System32\logon.scr
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\System32\taskmgr.exe
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\System32\zipfldr.dll
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\notepad.exe
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\NOTEPAD.EXE
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\mshta.exe
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\software\HijackThis.exe
DEL HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
MOD HKEY_CURRENT_USER\SessionInformation\ProgramCount
MOD HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
MOD HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
MOD HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window_Placement
MOD HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs\url1
MOD HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs\url2
MOD HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs\url3
MOD HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs\url4
MOD HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs\url5
MOD HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs\url6
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU\MRUList
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\MRUList
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\a
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\b
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\c
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\d
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\e
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\f
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\g
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\h
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\i
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\j
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum\Implementing
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum\Implementing
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew\~reserved~
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\MRUListEx
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\MRUListEx
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Balloon_Time
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\HRZR_HVGBBYONE
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\Cebtenz\Vagrearg Rkcybere\vrkcyber.rkr
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\Cebtenz\flfgrzfureybpx\qhzc.ong
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\JVAQBJF\Flfgrz32\ABGRCNQ.RKR
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\fbsgjner\UvwnpxGuvf.rkr
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACVQY
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACVQY:::{2559N1S4-21Q7-11Q4-OQNS-00P04S60O9S0}
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHAPCY
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\0\MRUListEx
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\MRUListEx
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU\NodeSlots
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\MinPos800x600(1).x
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\MinPos800x600(1).y
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\WinPos800x600(1).bottom
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\WinPos800x600(1).left
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\WinPos800x600(1).right
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\WinPos800x600(1).top
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\MinPos800x600(1).x
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\MinPos800x600(1).y
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\WinPos800x600(1).bottom
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\WinPos800x600(1).left
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\WinPos800x600(1).right
MOD HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\WinPos800x600(1).top
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\049811056AFE9FD0F5BE01685AACE6A5D1C4454C\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F55E8839BAC30728BE7108EDE7B0BB0D3298224\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\209900B63D955728140CD13622D8C687A4EB0085\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\216B2A29E62A00CE820146D8244141B92511B279\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\23E594945195F2414803B4D564D2A3A3F5D88B8C\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24A40A1F573643A67F0A4B0749F6A22BF28ABB6B\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24BA6D6C8A5B5837A48DB5FAE919EA675C94D217\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\284F55C41A1A7A3F8328D4C262FB376ED6096F24\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2F173F7DE99667AFA57AF80AA2D1B12FAC830338\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\36863563FD5128C7BEA6F005CFE9B43668086CCE\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\394FF6850B06BE52E51856CC10E180E882B385CC\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4072BA31FEC351438480F62E6CB95508461EAB2F\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43DDB1FFF3B49B73831407F6BC8B975023D07C50\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4463C531D7CCC1006794612BB656D3BF8257846F\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47AFB915CDA26D82467B97FA42914468726138DD\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4B421F7515F6AE8A6ECEF97F6982A400A4D9224E\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4BA7B9DDD68788E12FF852E1A024204BF286A8F6\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4C95A9902ABE0777CED18D6ACCC3372D2748381E\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\54F9C163759F19045121A319F64C2D0555B7E073\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\58119F0E128287EA50FDD987456F4F78DCFAD6D4\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5B4E0EC28EBD8292A51782241281AD9FEEDD4E4C\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5D989CDB159611365165641B560FDBEA2AC23EF1\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5E5A168867BFFF00987D0B1DC2AB466C4264F956\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5E997CA5945AAB75FFD14804A974BF2AE1DFE7E1\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6372C49DA9FFF051B8B5C7D4E5AAE30384024B9C\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6782AAE0EDEEE21A5839D3C0CD14680A4F60142A\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\67EB337B684CEB0EC2B0760AB488278CDD9597DD\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\687EC17E0602E3CD3F7DFBD7E28D57A0199A3F44\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\688B6EB807E8EDA5C7B17C4393D0795F0FAE155F\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\68ED18B309CD5291C0D3357C1D1141BF883866B1\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\69BD8CF49CD300FB592E1793CA556AF3ECAA35FB\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6A174570A916FBE84453EED3D070A1D8DA442829\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\720FC15DDC27D456D098FABF3CDD78D31EF5A8DA\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\74207441729CDD92EC7931D823108DC28192E2BB\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7639C71847E151B5C7EA01C758FBF12ABA298F7A\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\78E9DD0650624DB9CB36B50767F209B843BE15B3\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7A74410FB0CD5C972A364B71BF031D88A6510E9E\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7AC5FFF8DCBC5583176877073BF751735E9BD358\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7CA04FD8064C1CAA32A37AA94375038E8DF8DDC0\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\81968B3AEF1CDC70F5FA3269C292A3635BD123D3\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\838E30F77FDD14AA385ED145009C0E2236494FAA\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\879F4BEE05DF98583BE360D633E70D3FFE9871AF\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8EB03FC3CF7BB292866268B751223DB5103405CB\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9078C5A28F9A4325C2A7C73813CDFE13C20F934E\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\90AEA26985FF14804C434952ECE9608477AF556F\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\90DEDE9E4C4E9F6FD88617579DD391BC65A68964\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\96974CD6B663A7184526B1D648AD815CF51E801A\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\99A69BE61AFE886B4D2B82007CB854FC317E1539\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9BACF3B664EAC5A17BED08437C72E4ACDA12F7E7\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9E6CEB179185A29EC6060CA53E1974AF94AF59D4\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9FC796E8F8524F863AE1496D381242105F1B78F5\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A399F76F0CBF4C9DA55E4AC24E8960984B2905B6\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A3E31E20B2E46A328520472D0CDE9523E7260C6D\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A5EC73D48C34FCBEF1005AEB85843524BBFAB727\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AB48F333DB04ABB9C072DA5B0CC1D057F0369B46\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ACED5F6553FD25CE015F1F7A483B6A749F6178C6\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B172B1A56D95F91FE50287E14D37EA6A4463768A\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B19DD096DCD4E3E0FD676885505A672C438D4E9C\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B3EAC44776C9C81CEAF29D95B6CCA0081B67EC9D\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B5D303BF8682E152919D83F184ED05F1DCE5370C\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B6AF5BE5F878A00114C3D7FEF8C775C34CCD17B6\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B72FFF92D2CE43DE0A8D4C548C503726A81E2B93\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BC9219DDC98E14BF1A781F6E280B04C27F902712\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABB51672400588E6419F1D40878D0403AA20264\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFDEFE102FDA05BBE4C78D2E4423589005B2571D\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFF360F524CB20F1FEAD89006F7F586A285B2D5B\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFF810FB2C4FFC0156BFE1E1FABCB418C68D31C5\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D29F6C98BEFC6D986521543EE8BE56CEBC288CF3\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D2EDF88B41B6FE01461D6E2834EC7C8F6C77721E\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DA40188B9189A3EDEEAEDA97FE2F9DF5B7D18A41\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DBAC3C7AA4254DA1AA5CAAD68468CB88EEDDEEA8\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E392512F0ACFF505DFF6DE067F7537E165EA574B\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E4554333CA390E128B8BF81D90B70F4002D1D6E9\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E5DF743CB601C49B9843DCAB8CE86A81109FE48E\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EBBC0E2D020CA69B222C2BFFD203CB8BF5A82766\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EC0C3716EA9EDFADD35DFBD55608E60A05D3CBF3\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EF2DACCBEABB682D32CE4ABD6CB90025236C07BC\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F44095C238AC73FC4F77BF8F98DF70F8F091BC52\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F88015D3F98479E1DA553D24FD42BA3F43886AEF\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\063DA67748F0ECCC690D319BCDCD0E72AC8D48D5\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\12519AE9CD777A560184F1FBD54215222E95E71F\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\189271E573FED295A8C130EAF357A20C4A9F115E\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2D69A20EC4F0CD19037FD6D6246B1EE0EC41BA22\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B02312BACC59EC388FEAE12FD277F6A9FB4FAC1\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9F025D9F58711A605EB0694B0E8BC0CA4F25FD6F\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\BA9E3C32562A67128CAABD4AB0C500BEE1D0C256\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\F6357239B7C39725BD8000646E4A0D18EBCE4CFA\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FE622EA7B33CA46519AB39736A66B8F6E41FF157\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob
MOD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dhcp\Parameters\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\CategoryMessageFile
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DataBasePath
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\LeaseObtainedTime
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\LeaseTerminatesTime
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\T1
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\T2
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\Parameters\Tcpip\LeaseObtainedTime
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\Parameters\Tcpip\LeaseTerminatesTime
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\Parameters\Tcpip\T1
MOD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\Parameters\Tcpip\T2
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESENT\CategoryMessageFile
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESENT\EventMessageFile
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\LeaseObtainedTime
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\LeaseTerminatesTime
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\T1
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\T2
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\Parameters\Tcpip\LeaseObtainedTime
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\Parameters\Tcpip\LeaseTerminatesTime
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\Parameters\Tcpip\T1
MOD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{BC24B697-4C1E-4D3C-89B7-B171BA2A583F}\Parameters\Tcpip\T2
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\SessionInformation\ProgramCount
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\Main\Search Page
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\Main\Start Page
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\Main\Window_Placement
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\TypedURLs\url1
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\TypedURLs\url2
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\TypedURLs\url3
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\TypedURLs\url4
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\TypedURLs\url5
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Internet Explorer\TypedURLs\url6
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU\MRUList
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\MRUList
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\a
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\b
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\c
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\d
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\e
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\f
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\g
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\h
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\i
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\j
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum\Implementing
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum\Implementing
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew\~reserved~
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\MRUListEx
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\MRUListEx
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Balloon_Time
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\HRZR_HVGBBYONE
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\Cebtenz\Vagrearg Rkcybere\vrkcyber.rkr
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\Cebtenz\flfgrzfureybpx\qhzc.ong
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\JVAQBJF\Flfgrz32\ABGRCNQ.RKR
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\fbsgjner\UvwnpxGuvf.rkr
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACVQY
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACVQY:::{2559N1S4-21Q7-11Q4-OQNS-00P04S60O9S0}
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHAPCY
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\0\MRUListEx
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\MRUListEx
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\NodeSlots
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\MinPos800x600(1).x
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\MinPos800x600(1).y
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\WinPos800x600(1).bottom
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\WinPos800x600(1).left
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\WinPos800x600(1).right
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\5\Shell\WinPos800x600(1).top
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\MinPos800x600(1).x
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\MinPos800x600(1).y
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\WinPos800x600(1).bottom
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\WinPos800x600(1).left
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\WinPos800x600(1).right
MOD HKEY_USERS\S-1-5-21-1229272821-413027322-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\8\Shell\WinPos800x600(1).top
MOD c:\Documents and Settings\Roger\Application Data\Microsoft
MOD c:\Documents and Settings\Roger\Cookies
MOD c:\Documents and Settings\Roger\Cookies\index.dat
MOD c:\Documents and Settings\Roger\Lokala inställningar\Temp
MOD c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\492F49EJ
MOD c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ
MOD c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\8XMJGLIZ\google[1]
MOD c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\C12FS9AV
MOD c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\KHYB4HUB
MOD c:\Documents and Settings\Roger\Lokala inställningar\Temporary Internet Files\Content.IE5\index.dat
MOD c:\Documents and Settings\Roger\Lokala inställningar\Tidigare\History.IE5\index.dat
MOD c:\Documents and Settings\Roger\NTUSER.DAT
MOD c:\Documents and Settings\Roger\NTUSER.DAT.LOG
MOD c:\Documents and Settings\Roger\Recent
MOD c:\Documents and Settings\Roger\Recent\software.lnk
MOD c:\Documents and Settings\Roger\Skrivbord
MOD c:\Program\systemsherlock
MOD c:\Program\systemsherlock\before.dat
MOD c:\RECYCLER\S-1-5-21-1229272821-413027322-839522115-1003
MOD c:\RECYCLER\S-1-5-21-1229272821-413027322-839522115-1003\INFO2
MOD c:\WINDOWS
MOD c:\WINDOWS\Downloaded Program Files
MOD c:\WINDOWS\Prefetch
MOD c:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf
MOD c:\WINDOWS\Prefetch\HIJACKTHIS.EXE-37EAAAD9.pf
MOD c:\WINDOWS\Prefetch\IEXPLORE.EXE-350E1020.pf
MOD c:\WINDOWS\Prefetch\MSHTA.EXE-331DF029.pf
MOD c:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf
MOD c:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf
MOD c:\WINDOWS\Prefetch\SYSTEMSHERLOCK.EXE-3ABE9B82.pf
MOD c:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf
MOD c:\WINDOWS\setupapi.log
MOD c:\WINDOWS\system32
MOD c:\WINDOWS\system32\CatRoot2
MOD c:\WINDOWS\system32\CatRoot2\edb.chk
MOD c:\WINDOWS\system32\CatRoot2\edb.log
MOD c:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
MOD c:\WINDOWS\system32\config\SAM.LOG
MOD c:\WINDOWS\system32\config\SECURITY.LOG
MOD c:\WINDOWS\system32\config\software
MOD c:\WINDOWS\system32\config\software.LOG
MOD c:\WINDOWS\system32\config\system.LOG
MOD c:\software
Compare finished.