%user_profile%\appdata\local\temp\~nsu.tmp\au_.exe
%win_dir%\assembly\nativeimages_v4.0.30319_32\psiclient\d8c49ce64ecb257a31fbb428f396b8fb\psiclient.ni.dll
%user_profile%\appdata\local\temp\nsje584.tmp\system.dll