I don't really see how the victim will be dumb enough to share a file called xRegistery.sys.
I mean, it contains the word Registry... plus everyone smart enought to access the dev_flash folder (not available until activated with a tool or an option, if i recall right), won't fall for that.
Anyway, it can always work, yet i don't understant why we should do that.