start 
CloseProcesses:
Hosts:
CreateRestorePoint:
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [125]


EmptyTemp:
end