From 6e76b5b8eb29ed6442e703d7c7601d5c64bbfd60 Mon Sep 17 00:00:00 2001
From: 87owo <85057800+87owo@users.noreply.github.com>
Date: Mon, 12 Jan 2026 13:28:04 +0800
Subject: [PATCH] Add files via upload

---
 Plugins/Filter/ProtectRules.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/Plugins/Filter/ProtectRules.cpp b/Plugins/Filter/ProtectRules.cpp
index 4c5bb29..757feb8 100644
--- a/Plugins/Filter/ProtectRules.cpp
+++ b/Plugins/Filter/ProtectRules.cpp
@@ -41,7 +41,7 @@ const PCWSTR SafeSystemBinaries[] = {
 
 const PCWSTR CriticalSystemBinaries[] = {
     L"*\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
-    L"*\\Windows Defender\\MsMpEng.exe"
+    L"*\\Windows Defender\\MsMpEng.exe",
     L"*\\Windows\\System32\\lsass.exe",
     L"*\\Windows\\System32\\services.exe",
     L"*\\Windows\\System32\\wininit.exe",
@@ -58,7 +58,7 @@ const PCWSTR CriticalSystemBinaries[] = {
     L"*\\Windows\\System32\\SgrmBroker.exe",
     L"*\\Windows\\System32\\WerFault.exe",
     L"*\\Windows\\System32\\wbem\\WmiApSrv.exe",
-    L"*\\Windows\\System32\\wbem\\WmiPrvSE.exe"
+    L"*\\Windows\\System32\\wbem\\WmiPrvSE.exe",
     L"*\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
     L"*\\Windows\\System32\\ctfmon.exe",
     L"*\\Windows\\System32\\taskhostw.exe",
@@ -72,7 +72,8 @@ const PCWSTR CriticalSystemBinaries[] = {
     L"*\\Windows\\System32\\cleanmgr.exe",
     L"*\\Windows\\System32\\defrag.exe",
     L"*\\Windows\\System32\\chkdsk.exe",
-    L"*\\Windows\\System32\\conhost.exe"
+    L"*\\Windows\\System32\\conhost.exe",
+    L"*\\Windows\\System32\\RecoveryDrive.exe"
 };
 
 const PCWSTR SafeProcessPatterns[] = {