| ..\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell"\"%DAS%\ and Settings\admin\Local Settings\Temp\05A8958D.EXE"" |
| ..\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell"\"%DAS%\ and Settings\admin\Local Settings\Temp\05A8958D.EXE"" |
| ..\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell"\"%DAS%\ and Settings\admin\Local Settings\Temp\05A8958D.EXE"" |
| ..\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell"\"%DAS%\ and Settings\admin\Local Settings\Temp\05A8958D.EXE"" |
| ..\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell"\"%DAS%\ and Settings\admin\Local Settings\Temp\05A8958D.EXE"" |
| ..\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell"\"%DAS%\ and Settings\admin\Local Settings\Temp\05A8958D.EXE"" |
| ..\Software\hd\(Default) |
| ..\Software\Microsoft\esent\process\task\(Default) |
| ..\System\CurrentControlSet\Services\schedule\"localsystem"\"localsystem" |
| ..\Software\Microsoft\Windows\CurrentVersion\policies\explorer\run\"Cisvc"\"%DAS.AU.LS%\Temp\cisvc.exe /waitservice" |