The Windows directory on the corp Win7 machine here is 13.0GB.

And I actually have it, you know, in my Windows directory.

So it's just in your Windows directory.

If you go to the Windows directory and open the System32 folder, you should find a 101K file called clipbrd.exe.

With this mode enabled, the current directory is only searched after the Windows directories, rather than before.

And fake ones have been found in the Windows directory.

And although the directory is hidden under the main Windows directory, oh, my lord, after a few years, it is so full of stuff.

If not there, in the Windows directory.

Upon execution, Sober copies itself to one of several files in the Windows directory, depending on the variant.

The hash file should be stored in the Windows directory though, so no access without administrator privileges.