Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
- 'C:\ae615c4bc91adbc69a963b9ad2f78b\update\update.exe' /quiet /norestart /er /nobackup /log:%WINDIR%
- 'C:\bd2cc2e69678385eb85a029c7a20\update\nlsdl.exe' /quiet /norestart /er /nobackup /log:%WINDIR%
- 'C:\d13d092b07165cb21eaf\update\update.exe' /quiet /norestart /er /nobackup /log:%WINDIR%
- 'C:\bd2cc2e69678385eb85a029c7a20\update\xmllitesetup.exe' /quiet /norestart /er /nobackup /log:%WINDIR%
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\IE7Setup.cmd /nobackup /quiet /norestart
- '%TEMP%\IXP000.TMP\IE7-Setup.exe' /ieak-full:%TEMP%\IXP000.TMP\ /nobackup /quiet /norestart
- 'C:\bd2cc2e69678385eb85a029c7a20\update\iesetup.exe' /ieak-full:%TEMP%\IXP000.TMP\ /nobackup /quiet /norestart
- %WINDIR%\KB915865.log
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\spcustom.dll
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\updatebr.inf
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\inf\HFX3.tmp
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\KB915865.CAT
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\eula.txt
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\branches.inf
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\update_SP2GDR.inf
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\updspapi.dll
- C:\ae615c4bc91adbc69a963b9ad2f78b\spmsg.dll
- C:\ae615c4bc91adbc69a963b9ad2f78b\SP2QFE\xmllite.dll
- C:\ae615c4bc91adbc69a963b9ad2f78b\SP2GDR\xmllite.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\update_SP2QFE.inf
- C:\bd2cc2e69678385eb85a029c7a20\update\update.ver
- C:\bd2cc2e69678385eb85a029c7a20\update\eula.rtf
- C:\bd2cc2e69678385eb85a029c7a20\update\update.exe.manifest
- C:\bd2cc2e69678385eb85a029c7a20\$shtdwn$.req
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\update.ver
- %TEMP%\IXP000.TMP\filelist.dat
- %WINDIR%\ie7_main.log
- C:\bd2cc2e69678385eb85a029c7a20\update\update.inf
- C:\bd2cc2e69678385eb85a029c7a20\update\iereseticons.exe
- C:\bd2cc2e69678385eb85a029c7a20\update\idndl.exe
- C:\bd2cc2e69678385eb85a029c7a20\update\updspapi.dll
- C:\bd2cc2e69678385eb85a029c7a20\update\iesetup.exe
- C:\bd2cc2e69678385eb85a029c7a20\update\xmllitesetup.exe
- C:\bd2cc2e69678385eb85a029c7a20\update\update.exe
- C:\bd2cc2e69678385eb85a029c7a20\update\nlsdl.exe
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_.dll
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0003._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0011._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0000._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0002._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\spuninst.exe
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\update.exe
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0006._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0012._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0009._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0008._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0007._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0001._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0010._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0005._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0004._p
- %WINDIR%\KB915865.cat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\Cab6.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\OBJECTS.MAP
- <SYSTEM32>\SET8.tmp
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\NLSDownlevelMapping.cat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\INDEX.BTR
- %WINDIR%\NLSDownlevelMapping.cat
- %WINDIR%\NLSDownlevelMapping.log
- %WINDIR%\$hf_mig$\KB915865\update\KB915865.CAT
- %WINDIR%\$hf_mig$\KB915865\update\spcustom.dll
- %WINDIR%\$hf_mig$\KB915865\spmsg.dll
- %WINDIR%\$hf_mig$\KB915865\update\update.exe
- %WINDIR%\$hf_mig$\KB915865\update\update.ver
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\$hf_mig$\KB915865\update\updspapi.dll
- %WINDIR%\$hf_mig$\KB915865\spuninst.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB915865.cat
- %WINDIR%\$hf_mig$\KB915865\update\update_SP2QFE.inf
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %WINDIR%\$hf_mig$\KB915865\update\updatebr.inf
- C:\d13d092b07165cb21eaf\update\updspapi.dll
- C:\d13d092b07165cb21eaf\update\spcustom.dll
- C:\d13d092b07165cb21eaf\update\nlsdownlevelmapping.cat
- C:\d13d092b07165cb21eaf\update\update.exe
- C:\d13d092b07165cb21eaf\update\update.ver
- C:\d13d092b07165cb21eaf\update\eula.txt
- C:\d13d092b07165cb21eaf\update\update.inf
- C:\d13d092b07165cb21eaf\spupdsvc.exe
- <SYSTEM32>\SET4.tmp
- %WINDIR%\$hf_mig$\KB915865\update\branches.inf
- %WINDIR%\$hf_mig$\KB915865\update\eula.txt
- %WINDIR%\$hf_mig$\KB915865\SP2QFE\SET5.tmp
- C:\d13d092b07165cb21eaf\spuninst.exe
- C:\d13d092b07165cb21eaf\spmsg.dll
- C:\d13d092b07165cb21eaf\nlsdl.dll
- C:\bd2cc2e69678385eb85a029c7a20\update\legitlibm.dll
- C:\bd2cc2e69678385eb85a029c7a20\imgutil.dll
- C:\bd2cc2e69678385eb85a029c7a20\ieui.dll
- C:\bd2cc2e69678385eb85a029c7a20\iesetup.dll
- C:\bd2cc2e69678385eb85a029c7a20\inseng.dll
- C:\bd2cc2e69678385eb85a029c7a20\licmgr10.dll
- C:\bd2cc2e69678385eb85a029c7a20\jsproxy.dll
- C:\bd2cc2e69678385eb85a029c7a20\jscript.dll
- C:\bd2cc2e69678385eb85a029c7a20\iertutil.dll
- C:\bd2cc2e69678385eb85a029c7a20\ieencode.dll
- C:\bd2cc2e69678385eb85a029c7a20\iedkcs32.dll
- C:\bd2cc2e69678385eb85a029c7a20\ieapfltr.dll
- C:\bd2cc2e69678385eb85a029c7a20\ieframe.dll
- C:\bd2cc2e69678385eb85a029c7a20\iernonce.dll
- C:\bd2cc2e69678385eb85a029c7a20\ieproxy.dll
- C:\bd2cc2e69678385eb85a029c7a20\iepeers.dll
- C:\bd2cc2e69678385eb85a029c7a20\msfeeds.dll
- C:\bd2cc2e69678385eb85a029c7a20\shlwapi.dll
- C:\bd2cc2e69678385eb85a029c7a20\shdocvw.dll
- C:\bd2cc2e69678385eb85a029c7a20\pngfilt.dll
- C:\bd2cc2e69678385eb85a029c7a20\spmsg.dll
- C:\bd2cc2e69678385eb85a029c7a20\vbscript.dll
- C:\bd2cc2e69678385eb85a029c7a20\urlmon.dll
- C:\bd2cc2e69678385eb85a029c7a20\url.dll
- C:\bd2cc2e69678385eb85a029c7a20\occache.dll
- C:\bd2cc2e69678385eb85a029c7a20\mshtmled.dll
- C:\bd2cc2e69678385eb85a029c7a20\mshtml.dll
- C:\bd2cc2e69678385eb85a029c7a20\msfeedsbs.dll
- C:\bd2cc2e69678385eb85a029c7a20\mshtmler.dll
- C:\bd2cc2e69678385eb85a029c7a20\mstime.dll
- C:\bd2cc2e69678385eb85a029c7a20\msrating.dll
- C:\bd2cc2e69678385eb85a029c7a20\msls31.dll
- C:\bd2cc2e69678385eb85a029c7a20\ieakui.dll
- %TEMP%\IXP000.TMP\IE7-Setup.exe
- %TEMP%\IXP000.TMP\iesetup.ini
- %TEMP%\IXP000.TMP\INSTALL.INS
- %TEMP%\IXP000.TMP\IE7Setup.cmd
- C:\bd2cc2e69678385eb85a029c7a20\ieeula.chm
- C:\bd2cc2e69678385eb85a029c7a20\ieakmmc.chm
- C:\bd2cc2e69678385eb85a029c7a20\inetres.adm
- %TEMP%\IXP000.TMP\BRANDING.CAB
- %TEMP%\IXP000.TMP\advpack.dll
- %TEMP%\IXP000.TMP\Urlmon.dll
- %TEMP%\IXP000.TMP\Wininet.dll
- %TEMP%\IXP000.TMP\inseng.dll
- %TEMP%\IXP000.TMP\iesetup.cif
- %TEMP%\IXP000.TMP\iedkcs32.dll
- %TEMP%\IXP000.TMP\ieakcust.dll
- C:\bd2cc2e69678385eb85a029c7a20\iesupp.chm
- C:\bd2cc2e69678385eb85a029c7a20\extmgr.dll
- C:\bd2cc2e69678385eb85a029c7a20\dxtrans.dll
- C:\bd2cc2e69678385eb85a029c7a20\dxtmsft.dll
- C:\bd2cc2e69678385eb85a029c7a20\hmmapi.dll
- C:\bd2cc2e69678385eb85a029c7a20\ieaksie.dll
- C:\bd2cc2e69678385eb85a029c7a20\ieakeng.dll
- C:\bd2cc2e69678385eb85a029c7a20\icardie.dll
- C:\bd2cc2e69678385eb85a029c7a20\custsat.dll
- C:\bd2cc2e69678385eb85a029c7a20\ieapfltr.dat
- C:\bd2cc2e69678385eb85a029c7a20\inetcpl.cpl
- C:\bd2cc2e69678385eb85a029c7a20\iexplore.chm
- C:\bd2cc2e69678385eb85a029c7a20\admparse.dll
- C:\bd2cc2e69678385eb85a029c7a20\corpol.dll
- C:\bd2cc2e69678385eb85a029c7a20\browseui.dll
- C:\bd2cc2e69678385eb85a029c7a20\advpack.dll
- C:\bd2cc2e69678385eb85a029c7a20\vgx.dll
- C:\bd2cc2e69678385eb85a029c7a20\msfeedsbs.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\licmgr10.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\inseng.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\mshta.exe.mui
- C:\bd2cc2e69678385eb85a029c7a20\mshtmler.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\mshtmled.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\mshtml.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\inetcpl.cpl.mui
- C:\bd2cc2e69678385eb85a029c7a20\iernonce.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\iepeers.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\ieframe.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\iesetup.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\iexplore.exe.mui
- C:\bd2cc2e69678385eb85a029c7a20\ieunatt.exe.mui
- C:\bd2cc2e69678385eb85a029c7a20\ieui.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\msrating.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\infobar.wav
- C:\bd2cc2e69678385eb85a029c7a20\feeddisc.wav
- C:\bd2cc2e69678385eb85a029c7a20\mshtml.tlb
- C:\bd2cc2e69678385eb85a029c7a20\navstart.wav
- C:\bd2cc2e69678385eb85a029c7a20\update\iecustom.dll
- C:\bd2cc2e69678385eb85a029c7a20\update\ie7.cat
- C:\bd2cc2e69678385eb85a029c7a20\popupblk.wav
- C:\bd2cc2e69678385eb85a029c7a20\ticrf.rat
- C:\bd2cc2e69678385eb85a029c7a20\webcheck.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\urlmon.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\occache.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\winfxdocobj.exe.mui
- C:\bd2cc2e69678385eb85a029c7a20\icrav03.rat
- C:\bd2cc2e69678385eb85a029c7a20\tdc.ocx
- C:\bd2cc2e69678385eb85a029c7a20\wininet.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\iedw.exe.mui
- C:\bd2cc2e69678385eb85a029c7a20\winfxdocobj.exe
- C:\bd2cc2e69678385eb85a029c7a20\spupdsvc.exe
- C:\bd2cc2e69678385eb85a029c7a20\spuninst.exe
- C:\bd2cc2e69678385eb85a029c7a20\html.iec
- C:\bd2cc2e69678385eb85a029c7a20\ieuinit.inf
- C:\bd2cc2e69678385eb85a029c7a20\inetset.iem
- C:\bd2cc2e69678385eb85a029c7a20\inetcorp.iem
- C:\bd2cc2e69678385eb85a029c7a20\mshta.exe
- C:\bd2cc2e69678385eb85a029c7a20\ie4uinit.exe
- C:\bd2cc2e69678385eb85a029c7a20\wininet.dll
- C:\bd2cc2e69678385eb85a029c7a20\webcheck.dll
- C:\bd2cc2e69678385eb85a029c7a20\iedw.exe
- C:\bd2cc2e69678385eb85a029c7a20\msfeedssync.exe
- C:\bd2cc2e69678385eb85a029c7a20\iexplore.exe
- C:\bd2cc2e69678385eb85a029c7a20\ieudinit.exe
- C:\bd2cc2e69678385eb85a029c7a20\occache.ini
- C:\bd2cc2e69678385eb85a029c7a20\ie4uinit.exe.mui
- C:\bd2cc2e69678385eb85a029c7a20\icardie.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\html.iec.mui
- C:\bd2cc2e69678385eb85a029c7a20\ieakeng.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\iedkcs32.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\ieakui.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\ieaksie.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\hmmapi.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\msfeeds.mof
- C:\bd2cc2e69678385eb85a029c7a20\install.ins
- C:\bd2cc2e69678385eb85a029c7a20\webcheck.ini
- C:\bd2cc2e69678385eb85a029c7a20\msfeedsbs.mof
- C:\bd2cc2e69678385eb85a029c7a20\extmgr.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\advpack.dll.mui
- C:\bd2cc2e69678385eb85a029c7a20\admparse.dll.mui
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\NLSDownlevelMapping.cat
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB915865.cat
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- C:\ae615c4bc91adbc69a963b9ad2f78b\SP2QFE\xmllite.dll
- C:\ae615c4bc91adbc69a963b9ad2f78b\spmsg.dll
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\updspapi.dll
- C:\ae615c4bc91adbc69a963b9ad2f78b\SP2GDR\xmllite.dll
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\spcustom.dll
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\KB915865.CAT
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\updatebr.inf
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\eula.txt
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\update.ver
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\update.exe
- %WINDIR%\_000000_.tmp.dll
- %TEMP%\Cab6.tmp
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\update_SP2GDR.inf
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\branches.inf
- C:\ae615c4bc91adbc69a963b9ad2f78b\spuninst.exe
- C:\ae615c4bc91adbc69a963b9ad2f78b\update\update_SP2QFE.inf
- %WINDIR%\inf\oem3.PNF
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0005._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0004._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0007._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0006._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0001._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0000._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0003._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0002._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0008._p
- %WINDIR%\inf\_000000_.tmp.dll
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_.dll
- %WINDIR%\inf\oem3.inf
- %WINDIR%\_000001_.tmp.dll
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0010._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0009._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0012._p
- C:\ae615c4bc91adbc69a963b9ad2f78b\_sfx_0011._p
- from %WINDIR%\inf\branches.inf to %WINDIR%\inf\_000000_.tmp.dll
- from %WINDIR%\NLSDownlevelMapping.cat to %WINDIR%\_000000_.tmp.dll
- from <SYSTEM32>\SET8.tmp to <SYSTEM32>\nlsdl.dll
- from %WINDIR%\$hf_mig$\KB915865\SP2QFE\SET5.tmp to %WINDIR%\$hf_mig$\KB915865\SP2QFE\xmllite.dll
- from %WINDIR%\KB915865.cat to %WINDIR%\_000001_.tmp.dll
- from <SYSTEM32>\SET4.tmp to <SYSTEM32>\xmllite.dll
- 'www.download.windowsupdate.com':80
- 'wp#d':80
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- http://11#.#11.111.1/wpad.dat via wp#d
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
- ClassName: 'Shell_TrayWnd' WindowName: ''