1\DrWebLwf43\Dr.Web Security Space41\Doctor Web43\Doctor Web43\Microsoft Antimalware43\Local\Mozilla\Firefox43\Roaming\Mozilla\Firefox41\Software\Classes\Local Settings\MuiCache41\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify41\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell41\Software\Microsoft\Direct3D\MostRecentApplication41\Software\Microsoft\DirectInput\MostRecentApplication41\Software\Microsoft\Internet Explorer\International\CpMRU41\Software\Microsoft\Internet Explorer\TypedUrls41\Software\Microsoft\Windows Mail41\Software\Microsoft\Windows NT\CurrentVersion\TaskManager41\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks41\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog41\Software\Microsoft\Windows\CurrentVersion\Applets41\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable41\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder41\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs41\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU41\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo41\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage41\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU41\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams41\Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify41\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist41\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached41HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\UpdateExeVolatile40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Superfetch40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kmixer40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS40HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CMF40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Diagnostics40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nsi40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search40HKEY_LOCAL_MACHINE\SYSTEM\LastKnownGoodRecovery40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender40HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo40HKEY_LOCAL_MACHINE\SOFTWARE\COMODO40\SOFTWARE\Agnitum41\Software\ChemTable Software\41HKEY_LOCAL_MACHINE\SYSTEM\ControlSet0041\Software\Microsoft\RestartManager41\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg3241\KasperskyLab40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Reliability Analysis40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG40HKEY_LOCAL_MACHINE\SYSTEM\RNG40HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces41\Software\Microsoft\Windows\CurrentVersion\Ext\Stats40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SchedulingAgent40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM41\Windows NT\CurrentVersion\ProfileList\40HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform41\Software\Microsoft\Search Assistant\41\SessionInformation\44C:\RECYCLER44C:\$RECYCLE.BIN44C:\System Volume Information44C:\Windows\system32\config44C:\Windows\system32\LogFiles44C:\Windows\system32\SMI\Store\Machine44C:\Windows\system32\WDI44C:\Windows\system32\wbem44C:\Windows\system32\winevt\Logs44C:\Windows\Prefetch44C:\Windows\SoftwareDistribution44C:\Windows\winsxs45\Microsoft\Windows Live\Services\Cache45\Microsoft\Windows\Temporary Internet Files45\Microsoft\Windows\Cookies45\Microsoft\Search45\Microsoft\Network\Downloader45\Microsoft\RAC45\Microsoft\Windows Defender45\Microsoft\WER45\Agnitum\45\COMODO\45\Kaspersky Lab\45\ChemTable Software\42C:\pagefile.sys40HKEY_LOCAL_MACHINE\BCD0000000040HKEY_LOCAL_MACHINE\COMPONENTS40HKEY_LOCAL_MACHINE\Schema40HKEY_LOCAL_MACHINE\Drivers40HKEY_LOCAL_MACHINE\HARDWARE40HKEY_LOCAL_MACHINE\SAM40HKEY_LOCAL_MACHINE\SECURITY44C:\Boot44C:\ProgramData\Microsoft\Network\Downloader44C:\ProgramData\Microsoft\Windows\WER44C:\ProgramData\Microsoft\Search44C:\ProgramData\Microsoft\Debug44C:\WINDOWS\LastGood44C:\WINDOWS\Logs44C:\WINDOWS\Registration45\system32\CatRoot45\NTUSER.dat44\Microsoft\CryptnetUrlCache\Content43\WindowsUpdate.log42C:\Windows\System32\msiexec.exe25\Windows Sidebar2