; Directories

Program Files\
ProgramData\
Sources\

Windows\Boot\Fonts\
Windows\Boot\Resources\
Windows\Fonts\
Windows\inf\
Windows\servicing\

Windows\system32\boot\
Windows\system32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\
Windows\system32\Dism\
Windows\system32\downlevel\
Windows\system32\driverstore\
Windows\system32\drivers\
Windows\system32\SMI\
;Windows\system32\en-US\
Windows\System32\migration\
Windows\system32\wbem\

Windows\winsxs\*_microsoft-windows-servicingstack*\
Windows\winsxs\*_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82*\
Windows\winsxs\*_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0*\
Windows\winsxs\*_microsoft.windows.common-controls*\
Windows\winsxs\*_microsoft.windows.gdiplus*\
Windows\winsxs\*_microsoft.windows.isolationautomation*\
Windows\winsxs\*_microsoft-windows-riched32*\

Windows\SystemResources\

; Files
Users\Default\NTUSER.DAT
Windows\*.exe
Windows\*.ini

Windows\Boot\EFI\*.efi
Windows\Boot\EFI\*.stl

Windows\Globalization\Sorting\SortDefault.nls

Windows\System32\config\SYSTEM
Windows\System32\config\SECURITY
Windows\System32\config\COMPONENTS
Windows\System32\config\DRIVERS
Windows\system32\config\SAM

Windows\system32\*.cmd
Windows\system32\*.com
Windows\system32\*.nls
Windows\system32\kbd*.dll
Windows\system32\*base.dll

Windows\System32\CodeIntegrity\driver.stl

Windows\System32\aclui.dll
Windows\System32\activeds.dll
Windows\System32\advapi32.dll
Windows\System32\advpack.dll
Windows\System32\apisetschema.dll
Windows\System32\asycfilt.dll
Windows\System32\atl.dll
Windows\system32\atmfd.dll
Windows\System32\atmlib.dll

Windows\System32\attrib.exe
Windows\System32\authui.dll
Windows\System32\authz.dll
Windows\System32\autochk.exe
Windows\System32\autoconv.exe
Windows\System32\basesrv.dll
Windows\System32\bcd.dll
Windows\System32\bcdboot.exe
Windows\System32\bcdedit.exe
Windows\System32\bcdprov.dll
Windows\System32\bcdsrv.dll
Windows\System32\BCP47Langs.dll
Windows\System32\bcrypt.dll
Windows\System32\bcryptprimitives.dll
Windows\System32\blbres.dll
Windows\System32\blb_ps.dll
Windows\System32\bmrui.exe
Windows\System32\bootcfg.exe
Windows\System32\BootMenuUX.dll
Windows\System32\BootRec.exe
Windows\System32\bootsect.exe
Windows\System32\bootstr.dll
Windows\System32\bootux.dll
Windows\System32\BOOTVID.DLL
Windows\System32\BrokerLib.dll
Windows\System32\browcli.dll
Windows\System32\browseui.dll
Windows\System32\cabinet.dll
Windows\System32\cdd.dll
Windows\System32\certcli.dll
Windows\System32\cfgmgr32.dll

Windows\system32\chakra.dll
Windows\system32\chakradiag.dll
;TH2
Windows\system32\Chakrathunk.dll

Windows\System32\chcp.com
Windows\System32\chkdsk.exe
Windows\System32\chkntfs.exe
Windows\System32\chkwudrv.dll
Windows\System32\ci.dll
Windows\System32\clb.dll
Windows\System32\clusapi.dll
Windows\System32\cmd.exe
Windows\System32\cmdext.dll
;Windows\System32\cmipnpinstall.dll
Windows\System32\cnvfat.dll
;Windows\System32\combase.dll
Windows\System32\comcat.dll
Windows\System32\comdlg32.dll
Windows\System32\coml2.dll
Windows\System32\comres.dll
Windows\system32\compact.exe
Windows\System32\conhost.exe
Windows\System32\console.dll
Windows\System32\convert.exe
Windows\System32\credui.dll
Windows\System32\crypt32.dll
;Windows\System32\cryptbase.dll
Windows\System32\cryptdlg.dll
Windows\System32\cryptdll.dll
Windows\System32\cryptext.dll
Windows\system32\cryptnet.dll
Windows\System32\cryptsp.dll
Windows\System32\cryptsvc.dll
Windows\System32\cryptui.dll
Windows\System32\cryptxml.dll
Windows\System32\cscript.exe
Windows\System32\csrsrv.dll
Windows\System32\csrss.exe
Windows\System32\C_1252.NLS
Windows\System32\d2d1.dll
Windows\System32\dab.dll
Windows\System32\dabapi.dll
Windows\system32\davhlpr.dll
Windows\system32\dbgcore.dll
Windows\System32\dbgeng.dll
Windows\System32\dbghelp.dll
Windows\system32\dbgmodel.dll
Windows\System32\defragproxy.dll
Windows\System32\defragsvc.dll
Windows\System32\devobj.dll
Windows\System32\devrtl.dll
Windows\System32\dfscli.dll
Windows\system32\dhcpcore.dll
Windows\system32\dhcpcore6.dll
Windows\System32\dhcpcsvc.dll
Windows\System32\dhcpcsvc6.dll
Windows\system32\directmanipulation.dll
Windows\System32\diskpart.exe
Windows\System32\diskraid.exe
Windows\System32\Dism.exe
Windows\System32\DismApi.dll
Windows\System32\dispci.dll
Windows\System32\dispex.dll
Windows\System32\dllhost.exe
Windows\System32\dllhst3g.exe
Windows\System32\dnsapi.dll
Windows\system32\doskey.exe
Windows\System32\dpapi.dll
Windows\System32\dpapisrv.dll
Windows\system32\drvcfg.exe
Windows\System32\drvinst.exe
Windows\System32\drvload.exe
Windows\System32\drvstore.dll
Windows\System32\dskquota.dll
Windows\System32\dsparse.dll
Windows\System32\dsrole.dll
Windows\System32\dssenh.dll
Windows\System32\dui70.dll
Windows\System32\duser.dll
Windows\System32\dwmapi.dll
Windows\system32\dwrite.dll
Windows\System32\dxgwdi.dll
Windows\System32\esent.dll
Windows\System32\esentutl.exe
Windows\System32\EventAggregation.dll
Windows\System32\eventcls.dll
Windows\System32\expand.exe
Windows\System32\fbwflib.dll
Windows\System32\feclient.dll
Windows\System32\find.exe
Windows\System32\FirewallAPI.dll
Windows\System32\fltLib.dll
Windows\System32\fltMC.exe
Windows\System32\fmifs.dll
Windows\System32\fms.dll
Windows\System32\fontsub.dll
Windows\System32\format.com
Windows\System32\framedyn.dll
Windows\System32\framedynos.dll
Windows\System32\fsutil.exe
Windows\System32\fsutilext.dll
Windows\System32\ftp.exe
Windows\System32\fveapi.dll
Windows\System32\fvecerts.dll

	Windows\System32\mintdh.dll
	Windows\System32\fveui.dll
	Windows\system32\ResetEng.dll
	Windows\system32\VSSVC.exe
	Windows\system32\dpx.dll
	Windows\system32\idndl.dll
	Windows\system32\joinproviderol.dll
	Windows\system32\win32u.dll
	Windows\system32\gdi32full.dll
	Windows\system32\OneCoreCommonProxyStub.dll
	Windows\system32\wincredui.dll
	Windows\System32\advapi32res.dll

Windows\System32\FWPUCLNT.DLL
Windows\System32\gdi32.dll
Windows\System32\GdiPlus.dll
Windows\System32\gpapi.dll
Windows\System32\gpsvc.dll
Windows\System32\hal.dll

Windows\System32\HalExtIntcUartDMA.dll
Windows\System32\halmacpi.dll
Windows\System32\hhctrl.ocx
Windows\system32\hhsetup.dll
Windows\System32\hid.dll
Windows\System32\hidserv.dll
Windows\System32\HOSTNAME.EXE
Windows\System32\icacls.exe
Windows\System32\iertutil.dll
Windows\System32\ifmon.dll
Windows\System32\ifsutil.dll
Windows\System32\ifsutilx.dll
Windows\System32\imagehlp.dll
Windows\System32\imageres.dll
Windows\System32\imagesp1.dll
Windows\System32\imapi.dll
Windows\System32\imapi2.dll
Windows\System32\imapi2fs.dll
Windows\System32\imm32.dll
Windows\System32\input.dll
Windows\System32\IPHLPAPI.DLL
Windows\System32\jscript.dll
Windows\System32\jscript9.dll
Windows\system32\jscript9diag.dll
Windows\System32\jsproxy.dll
Windows\System32\KBDUS.DLL
Windows\System32\kd.dll
Windows\System32\kdcom.dll
Windows\System32\KdsCli.dll
Windows\System32\kdusb.dll
Windows\System32\kerberos.dll
Windows\System32\kernel32.dll
;Windows\System32\KernelBase.dll
Windows\System32\kmddsp.tsp
Windows\System32\ktmw32.dll
Windows\System32\linkinfo.dll
Windows\System32\loadperf.dll
Windows\System32\locale.nls
Windows\System32\logoncli.dll
Windows\System32\lpk.dll
Windows\System32\lsasrv.dll
Windows\System32\lsass.exe
Windows\System32\lsm.dll
Windows\System32\luainstall.dll
Windows\System32\lz32.dll
Windows\System32\l_intl.nls
Windows\System32\mcbuilder.exe
Windows\System32\MdSched.exe
Windows\System32\mfc42.dll
Windows\System32\mfc42u.dll
Windows\system32\mibincodec.dll
Windows\system32\mimofcodec.dll
Windows\system32\miutils.dll
Windows\System32\mode.com
Windows\System32\more.com
Windows\System32\mountvol.exe
Windows\System32\mpr.dll
Windows\System32\mprapi.dll
Windows\System32\msasn1.dll
Windows\System32\msctf.dll
Windows\System32\msftedit.dll
Windows\System32\msiltcfg.dll
Windows\System32\msimg32.dll
Windows\System32\msls31.dll
Windows\System32\msports.dll
Windows\System32\msprivs.dll
Windows\System32\msscript.ocx
Windows\System32\mssign32.dll
Windows\System32\msv1_0.dll
Windows\System32\msvcirt.dll
Windows\System32\msvcp60.dll
Windows\system32\msvcp_win.dll
Windows\system32\msvcp110_win.dll
Windows\System32\msvcrt.dll
Windows\System32\msvcrt40.dll
Windows\System32\mswsock.dll
Windows\System32\msxml3.dll
Windows\System32\msxml3r.dll
Windows\System32\msxml6.dll
Windows\System32\msxml6r.dll
Windows\System32\mtxdm.dll
Windows\System32\MuiUnattend.exe
Windows\System32\nci.dll
Windows\System32\ncobjapi.dll
Windows\System32\ncrypt.dll
Windows\system32\ncryptprov.dll
Windows\system32\ncryptsslp.dll
Windows\System32\ncsi.dll
Windows\system32\ncpa.cpl
Windows\System32\ndadmin.exe
Windows\System32\net.exe
Windows\System32\net1.exe
Windows\System32\netapi32.dll
Windows\System32\netjoin.dll
Windows\system32\netman.dll
Windows\System32\netmsg.dll
Windows\System32\NetSetupApi.dll
Windows\system32\NetSetupEngine.dll
Windows\system32\NetSetupShim.dll
Windows\system32\NetSetupSvc.dll
Windows\System32\NETSTAT.EXE
Windows\System32\netutils.dll
Windows\System32\newdev.dll
Windows\System32\newdev.exe
Windows\System32\ninput.dll
Windows\System32\nlaapi.dll
Windows\System32\nlasvc.dll
Windows\System32\normaliz.dll
Windows\System32\notepad.exe
Windows\System32\nrpsrv.dll
Windows\System32\nsi.dll
Windows\System32\nsisvc.dll
Windows\System32\ntasn1.dll
Windows\System32\ntdll.dll
Windows\System32\ntdsapi.dll
Windows\System32\ntlanman.dll
Windows\System32\NtlmShared.dll
Windows\System32\ntmarta.dll
Windows\System32\ntoskrnl.exe
Windows\System32\ntshrui.dll
Windows\System32\odbc32.dll
Windows\System32\odbcint.dll
Windows\System32\ole32.dll
Windows\System32\oleacc.dll
Windows\System32\oleaccrc.dll
Windows\System32\oleaut32.dll
Windows\System32\olepro32.dll
Windows\System32\OpenWith.exe
Windows\System32\osuninst.dll
Windows\System32\pcwum.dll
Windows\System32\PING.EXE
Windows\System32\PkgMgr.exe
Windows\System32\pnpui.dll
Windows\System32\poqexec.exe
Windows\System32\powrprof.dll
Windows\System32\profapi.dll
Windows\System32\profsvc.dll
Windows\System32\propsys.dll
Windows\System32\provthrd.dll
Windows\System32\prvdmofcomp.dll
Windows\System32\psapi.dll
Windows\System32\PSHED.DLL
Windows\System32\PSModuleDiscoveryProvider.dll
Windows\System32\psmodulediscoveryprovider.mof
Windows\System32\rasadhlp.dll
Windows\System32\rasapi32.dll
Windows\System32\rasman.dll
Windows\System32\ReAgent.dll
Windows\System32\recover.exe
Windows\System32\reg.exe
Windows\System32\regapi.dll
Windows\System32\regedt32.exe
Windows\System32\Register-CimProvider.exe
Windows\System32\regsvr32.exe
Windows\System32\ReInfo.dll
Windows\System32\replace.exe
Windows\System32\resutils.dll
Windows\System32\riched20.dll
Windows\System32\riched32.dll
Windows\System32\rnr20.dll
Windows\System32\Robocopy.exe
Windows\System32\ROUTE.EXE
Windows\System32\RpcEpMap.dll
Windows\System32\rpcrt4.dll
Windows\System32\RpcRtRemote.dll
Windows\System32\rpcss.dll
Windows\System32\rsaenh.dll
Windows\System32\rstrui.exe
Windows\System32\rtutils.dll
Windows\System32\rundll32.exe
Windows\System32\sacsess.exe
Windows\System32\sacsvr.dll
Windows\System32\samcli.dll
Windows\System32\samlib.dll
Windows\System32\samsrv.dll
Windows\System32\scecli.dll
Windows\System32\scesrv.dll
Windows\System32\schannel.dll
Windows\System32\schedcli.dll
Windows\System32\schema.dat
Windows\System32\scrobj.dll
Windows\System32\scrrun.dll
Windows\System32\sdhcinst.dll
Windows\System32\sechost.dll
Windows\System32\secur32.dll
Windows\System32\security.dll
Windows\System32\SensApi.dll
Windows\System32\services.exe
Windows\System32\setbcdlocale.dll
Windows\System32\setupapi.dll
Windows\System32\sfc.dll
Windows\System32\sfc.exe
Windows\System32\sfc_os.dll
Windows\System32\SHCore.dll
Windows\System32\shell32.dll
Windows\System32\shlwapi.dll
Windows\System32\slc.dll
Windows\System32\SmiEngine.dll
Windows\System32\smphost.dll
Windows\System32\smss.exe
Windows\System32\snmpapi.dll
Windows\System32\spfileq.dll
Windows\System32\SPInf.dll
Windows\System32\spp.dll
Windows\System32\sppc.dll
Windows\System32\sqmapi.dll
Windows\System32\srclient.dll
Windows\System32\srcore.dll
Windows\System32\srhelper.dll
Windows\System32\srms.dat
Windows\System32\srvcli.dll
Windows\System32\sspicli.dll
Windows\System32\sspisrv.dll
Windows\System32\SSShim.dll
Windows\System32\startnet.cmd
Windows\System32\stdole2.tlb
Windows\System32\stdole32.tlb
Windows\System32\Storprop.dll
Windows\System32\streamci.dll
Windows\System32\subst.exe
Windows\System32\svchost.exe
Windows\System32\sxproxy.dll
Windows\System32\sxs.dll
Windows\System32\sxshared.dll
Windows\System32\sxssrv.dll
Windows\System32\sxstrace.exe
Windows\System32\sysclass.dll
Windows\System32\sysntfy.dll
Windows\System32\sysreset.exe
Windows\System32\syssetup.dll
Windows\System32\SystemEventsBrokerServer.dll
Windows\System32\takeown.exe
Windows\System32\tapi32.dll
Windows\System32\taskmgr.exe
Windows\system32\tcpmib.dll
Windows\System32\tdh.dll
Windows\system32\tpmcertresources.dll
Windows\system32\tpmcoreprovisioning.dll
Windows\System32\TRACERT.EXE
Windows\System32\tree.com
Windows\System32\tsddd.dll
Windows\System32\tzres.dll
Windows\System32\ucsvc.exe
Windows\System32\uexfat.dll
Windows\System32\ufat.dll
Windows\system32\UIAutomationCore.dll
Windows\system32\UIAutomationCoreRes.dll
Windows\System32\ulib.dll
Windows\System32\umpnpmgr.dll
Windows\System32\umpo.dll
Windows\System32\unattend.dll
Windows\System32\untfs.dll
Windows\System32\uReFS.dll
Windows\system32\uReFSv1.dll
Windows\System32\ureg.dll
Windows\System32\urlmon.dll
Windows\System32\user32.dll
Windows\System32\userenv.dll
Windows\System32\userinit.exe
Windows\System32\userinitext.dll
Windows\System32\usp10.dll
Windows\System32\utildll.dll
Windows\System32\uudf.dll
Windows\System32\UXInit.dll
Windows\System32\uxtheme.dll
Windows\System32\vbscript.dll
Windows\System32\vdmdbg.dll
Windows\System32\vds.exe
Windows\System32\vdsbas.dll
Windows\System32\vdsdyn.dll
Windows\System32\vdsldr.exe
Windows\System32\vdsutil.dll
Windows\System32\vdsvd.dll
Windows\System32\vds_ps.dll
Windows\System32\verifier.dll
Windows\System32\verifier.exe
Windows\System32\version.dll
Windows\System32\virtdisk.dll
Windows\System32\vpnikeapi.dll
Windows\System32\vssapi.dll
Windows\System32\vsstrace.dll
Windows\System32\w32time.dll
Windows\System32\w32topl.dll
Windows\System32\wbadmin.exe
Windows\System32\wbemcomn.dll
Windows\System32\wbengine.exe
Windows\System32\wdigest.dll
Windows\System32\wdscapture.exe
Windows\System32\wdsclient.exe
Windows\System32\wdscore.dll
Windows\System32\wdsmcast.exe
Windows\System32\webio.dll
Windows\System32\webservices.dll
Windows\System32\wer.dll
Windows\System32\wermgr.exe
Windows\System32\werui.dll
Windows\System32\wevtapi.dll
Windows\System32\wevtsvc.dll
Windows\System32\wevtutil.exe
Windows\System32\WimBootCompress.ini
Windows\System32\wimgapi.dll
Windows\System32\wimserv.exe
Windows\System32\win32k.sys
Windows\System32\win32kbase.sys
Windows\System32\win32kfull.sys
Windows\System32\winbio.dll
Windows\System32\winbrand.dll
Windows\System32\wincorlib.dll
Windows\System32\Windows.Devices.HumanInterfaceDevice.dll
Windows\System32\WindowsCodecs.dll
Windows\System32\winhttp.dll
Windows\System32\wininet.dll
Windows\System32\wininit.exe
Windows\System32\wininitext.dll
Windows\System32\winload.efi
Windows\System32\winload.exe
Windows\System32\winlogon.exe
Windows\System32\winlogonext.dll
Windows\System32\winmm.dll
;Windows\System32\winmmbase.dll
Windows\System32\winnsi.dll
Windows\System32\winpeshl.exe
Windows\System32\WinSCard.dll
Windows\System32\winspool.drv
Windows\System32\winsrv.dll
Windows\System32\winsta.dll
Windows\System32\wintrust.dll
Windows\System32\wkscli.dll
Windows\System32\wkssvc.dll
Windows\System32\Wldap32.dll
Windows\System32\wldp.dll
Windows\System32\wmi.dll
Windows\system32\wmiclnt.dll
Windows\System32\wmicmiplugin.dll
Windows\System32\wmidcom.dll
Windows\System32\WmiMgmt.msc
Windows\System32\wmiprop.dll
Windows\System32\wmitomi.dll
Windows\System32\wmsgapi.dll
Windows\System32\WofUtil.dll
Windows\System32\wpeinit.exe
Windows\System32\wpeutil.dll
Windows\System32\wpeutil.exe
Windows\System32\ws2help.dll
Windows\System32\ws2_32.dll
Windows\System32\wscript.exe
Windows\System32\wshcon.dll
Windows\System32\wship6.dll
Windows\System32\wshom.ocx
Windows\System32\WSHTCPIP.DLL
Windows\System32\wsock32.dll
Windows\System32\wtsapi32.dll
Windows\System32\xcopy.exe
Windows\System32\xmllite.dll


;x86
Windows\System32\HalExtIntcLpioDMA.dll

Windows\WindowsShell.Manifest

Windows\WinSxS\manifests\*_microsoft-windows-servicingstack*
Windows\winsxs\manifests\*_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82*
Windows\winsxs\manifests\*_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0*
Windows\WinSxS\manifests\*_microsoft.windows.s..ation.badcomponents_*
Windows\winsxs\manifests\*_microsoft.windows.common-controls*
Windows\winsxs\manifests\*_microsoft.windows.gdiplus*
Windows\winsxs\manifests\*_microsoft.windows.isolationautomation*
Windows\WinSxS\manifests\*_microsoft.windows.i..utomation.proxystub_*
Windows\WinSxS\manifests\*_microsoft.windows.s...smart_card_library_*
Windows\WinSxS\manifests\*_microsoft.windows.s..rt_driver.resources_*
Windows\WinSxS\manifests\*_microsoft.windows.s..se.scsi_port_driver_*
Windows\WinSxS\manifests\*_microsoft.windows.systemcompatible_*
Windows\WinSxS\manifests\*_microsoft-windows-a..core-base.resources_*
Windows\WinSxS\manifests\*_microsoft-windows-blb-engine-main*
Windows\WinSxS\manifests\*_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_*
Windows\WinSxS\manifests\*_microsoft-windows-comdlg32.resources_31bf3856ad364e35_*
Windows\WinSxS\manifests\*_microsoft-windows-comdlg32_31bf3856ad364e35_*
Windows\winsxs\manifests\*_microsoft-windows-riched32*

; Build 14393
Windows\system32\Faultrep.dll
Windows\System32\weretw.dll
Windows\System32\werdiagcontroller.dll
Windows\System32\WerFault.exe
Windows\System32\WerFaultSecure.exe
; Build 15063
Windows\System32\wersvc.dll
Windows\System32\winsrvext.dll
Windows\System32\fontdrvhost.exe
: Build 18362
Windows\System32\umpdc.dll
Windows\System32\usermgr.dll
Windows\System32\usermgrproxy.dll
; Build 19041
Windows\System32\WerEnc.dll
Windows\System32\wermgr.exe
Windows\System32\Windows.UI.CredDialogController.dll
Windows\System32\windowsperformancerecordercontrol.dll
Windows\System32\aepic.dll
Windows\System32\TextShaping.dll

; MMC
Windows\system32\adsldpc.dll
Windows\system32\srvsvc.dll

; Recuva VSS
Windows\System32\vss_ps.dll
Windows\System32\swprv.dll