Trojan.MulDrop4.35695

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\2575.exe
%HOMEPATH%\Start Menu\Programs\Startup\4706.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\2922.exe

Modifies file system :

Creates the following files:

%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\9836.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\8711.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\2647.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\3039.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\1831.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities\0970.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\4096.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\1409.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\8445.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\0450.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\9166.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\1881.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\5930.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\2482.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\2072.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System\4884.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\1732.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\3213.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\v4.0_4.0.0.0__31bf3856ad364e35\5350.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\1325.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\7962.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\5927.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\4066.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\1074.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\0122.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\sysglobl\0680.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\6348.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\4963.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35\6067.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\4644.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\6863.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design\4834.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design\v4.0_4.0.0.0__b77a5c561934e089\1544.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\8330.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089\4747.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services\2330.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services\v4.0_4.0.0.0__b77a5c561934e089\9319.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\7240.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\1939.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Device\3955.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Device\v4.0_4.0.0.0__b77a5c561934e089\6889.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\4008.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\0838.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\6293.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\0034.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Design\9883.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\5869.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\1048.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\9825.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Core\7319.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\6566.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3475.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\7836.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\9799.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\3806.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.Design\2193.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\8998.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\1942.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\6402.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\9865.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\5549.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\6552.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Web\1434.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\7013.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\0847.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\6462.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Printing\1256.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\9408.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Transactions\3110.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Accessibility\4873.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\8263.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\1510.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\2276.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\1541.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\4449.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\6048.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\v4.0_4.0.0.0__b03f5f7f11d50a3a\8604.exe
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\7198.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\9576.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\8328.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\0066.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\8703.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\ISymWrapper\4571.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\2333.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\6840.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\0806.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\5620.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\7901.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\3168.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\2931.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\PresentationCore\4659.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\4345.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\3641.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\8841.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\2823.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\6385.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\7047.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\1755.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\5129.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\9523.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\4438.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\5156.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\3892.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\6347.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\5587.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\3033.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\2459.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\7152.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\1829.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\0775.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\7795.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\1484.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\6402.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\9908.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\8125.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\4598.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\8353.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\9685.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\1083.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\7137.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\2721.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\7276.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\3997.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\1430.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\4695.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\8147.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\1250.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing\1071.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Mobile\v4.0_4.0.0.0__b03f5f7f11d50a3a\6335.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design\5759.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design\v4.0_4.0.0.0__31bf3856ad364e35\3475.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Mobile\9044.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing\v4.0_4.0.0.0__31bf3856ad364e35\5227.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\4798.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\5193.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\9928.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\8716.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\4029.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\v4.0_4.0.0.0__b03f5f7f11d50a3a\6459.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\8116.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\9377.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization.Design\7869.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\6138.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\7005.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\0513.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\2215.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\8523.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\8698.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\v4.0_4.0.0.0__31bf3856ad364e35\1183.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.Design\7413.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\2615.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\9004.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity\v4.0_4.0.0.0__b77a5c561934e089\9560.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design\5694.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design\v4.0_4.0.0.0__31bf3856ad364e35\7638.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity\1064.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\1052.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\0023.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\3953.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\4374.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\3348.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml\3250.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\5301.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\9350.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\5853.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\WindowsBase\4653.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\1639.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\0327.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\v4.0_4.0.0.0__31bf3856ad364e35\0034.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\8247.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\9505.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\2571.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation\v4.0_4.0.0.0__b77a5c561934e089\9152.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\8510.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\v4.0_4.0.0.0__31bf3856ad364e35\6782.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation\7898.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\8325.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations\5910.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations\v4.0_4.0.0.0__b77a5c561934e089\3974.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\0394.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.WorkflowServices\v4.0_4.0.0.0__31bf3856ad364e35\8971.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\1730.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\5413.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.WorkflowServices\5208.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\v4.0_4.0.0.0__31bf3856ad364e35\5379.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime\4540.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime\v4.0_4.0.0.0__31bf3856ad364e35\9582.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\9705.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\7678.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Net\4024.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089\4890.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Management\7977.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\5771.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\6380.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Net\v4.0_4.0.0.0__b03f5f7f11d50a3a\8435.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\2481.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\4198.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\1730.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\0003.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\0207.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\3557.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\6511.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\8097.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\9407.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\0459.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\5914.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\9253.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\8859.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\8322.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\4968.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\0439.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\7746.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\9731.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\9427.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\2742.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\6893.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\5430.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\2549.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.ServiceMoniker40\v4.0_4.0.0.0__b77a5c561934e089\2664.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3899.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.WasHosting\v4.0_4.0.0.0__b77a5c561934e089\8831.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.ServiceMoniker40\8385.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery\v4.0_4.0.0.0__31bf3856ad364e35\0394.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\0580.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\v4.0_4.0.0.0__31bf3856ad364e35\3709.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\2457.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Speech\v4.0_4.0.0.0__31bf3856ad364e35\3089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Abstractions\1017.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Abstractions\v4.0_4.0.0.0__31bf3856ad364e35\4453.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Speech\3697.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\6556.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\5447.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\2696.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery\3343.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\3943.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Security\4630.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\5524.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\1731.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\5211.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\2654.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\3166.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\1211.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\v4.0_4.0.0.0__31bf3856ad364e35\9949.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\9467.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\4568.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\1987.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\2050.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\1721.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\v4.0_4.0.0.0__31bf3856ad364e35\0940.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\1490.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\2832.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\119750ae4265d719a24ebe245e212db7\1007.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\0517.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\015d6049e237304a27105c3846c79648\5911.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\5bd3f76680b4c09039d42ae873ddd190\5493.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\c171b28823047a7e9db5f3e092333336\6523.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\9639.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\79f9b2acf94065fd92c54c29ff66017b\6334.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\70764208219715962d310336b5959dfa\1533.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\6969.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\18e1acd6761195389db42bab83169fd2\3605.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\7150.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\d8a3d7926a927b9fd62aeabb16a74ab0\6969.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\1987.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\e5995a34d44ad5af7d9f335075bded4d\7363.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\9474.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\bfa7858f498cd67ef58b689c2e0fec89\6393.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\2102.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\a9e71dda6389403be4db7b567592e3b8\8314.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\0846.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Security\0418eb6dbffe9b46aa4c989153d6a3b5\2967.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\1016.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\19644a754454916a619b68315e50b428\5660.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Speech\9044.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web\50ea744ffc3cb7f09b027fd6c5c93b2b\7048.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\7245.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\fbe60d84b9f1ab74e396fb1507f69615\2152.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web\8638.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Speech\2e7a6c977ac9f8d46ebe2982697a0c8d\5631.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\5790.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\12903c3843fe923d1977801ffa3cf26c\5425.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1B.tmp\0519.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Temp\ZAP39.tmp\6116.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\5094.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1AC.tmp\2519.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\4585.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\8c0d96269480bdd3de8a825f0215308d\2986.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Temp\5937.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\d255ab525d10d8fefe5df9ba092b2df8\6457.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\9060.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\dbb2fcd246efaf3df823410597cd1677\7371.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WindowsBase\8452.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\8f5c0e1b77c840d99a68897898317b79\1506.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\9490.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\8698f073a59ef0db10a3258b1f1deaee\5970.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\6676.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\2868.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\8786.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\b5a285233229bb4f9d9831ebf27fe9ac\9926.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\7404.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\5985.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Services\6152.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Services\1dad08772eb89d48a8a0cfe9b0467eb0\3142.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\4349.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\d6cc33db5d526553ffbbfd1d372a8493\7706.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\9614.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\43911ac4e29949c57560eee5cb7b76c2\7935.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\9885.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\6d0966370023925610756f368140b947\5557.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\4179.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\9de33f5786cd15e220f47b916c5a15e9\7491.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\9660.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\8582bf6991112c859e843af4321a2fda\8473.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\fee2e476d10aac7784f46140ee1b4a59\6017.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Services\0569.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\3852.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\fa206c73f39721cd2c55829b9853de44\2348.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\0507.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\57f7cf02ea17b36bc3d9c75c22d0f551\3206.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Services\f24134b397836c33a65d4d05c54ef4f5\1408.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Design\9428.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Design\204db7071fb26343b0fd3f3d140c0bf8\9758.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\2506.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Deployment\df1efcbac5973454c608890f72eb994d\4020.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\2980.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\0ec1b690c5ee057fa92ecff78de1457c\4302.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Deployment\8693.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\4263.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb4cb21d14767292e079366a5d3d76cd\5784.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\3236.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\6c69930d05c557da70144bcc0add7065\4085.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\1860.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\a8e047504bdad9ec14efd483574b0dd5\1302.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\0770.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\22a1629a4dcdd493bbd8be40cc122e94\1988.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\1697.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\8c050147d7031f912f6ca2b15550173f\4816.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\4455.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\9867484f25281882e61f61066fa651a3\8394.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\6270.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\0b40341027c01716cec1dd97592698e0\5852.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\4690.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\4f4ddae492a4a4ce4a2961f3d72d9399\2986.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Messaging\643e95098a9ce99a598d3419b5ce157f\1716.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Net\0653.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Net\eabe1915c13467e1e66e2b073bcb842f\6849.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Messaging\0361.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\894d87c08a9a5b5923e7104055a616d2\4408.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.I#\2698.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.I#\1db9deebde7c96b2874b4ffccac2f48e\4012.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Printing\5433.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\01dc643b54310ebc5ab7e4696df426bc\0274.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\bb748f8ef8c98eb5c7f79b8faee95397\2905.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Security\3745.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\7018.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Printing\db428f231a2ccaf490ae219efd2edc69\3644.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\3363.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\3736ba3ecac186f9c5d85f01bda2be98\6538.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\5236.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\7325.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\1575.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\5f5d64dd0e7991aaaad2d98ee52afe42\7103.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\5879.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\44de75caba2b9711b3d9030a30767f8b\4175.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\6bcc481030a56c24d5990d199812c594\5942.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c205bbbb88bfa4bd5e274f43ea0013cb\0678.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\7041.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\94b2ca600c860c76e387f8bd317bd4c3\3446.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IO.Log\2916.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IO.Log\bcfccfa22245d2223a764611c61a7cb9\3045.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\3969.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\5f9cd5bfebcb94175d440ebab3aa412f\1913.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\4056.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\be8c7482f1e78a3b4984af9082d455a7\9220.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WindowsBase\df20e56b59b1b1a595af305ddc0777ba\2412.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\6983.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Video\1566.exe
%WINDIR%\ime\5887.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\0801.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Css\1163.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\6971.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\7631.exe
%WINDIR%\ime\chsime\0454.exe
%WINDIR%\ime\imejp\applets\6401.exe
%WINDIR%\ime\imejp98\5396.exe
%WINDIR%\ime\imjp8_1\2930.exe
%WINDIR%\ime\imejp\0012.exe
%WINDIR%\ime\chsime\applets\1468.exe
%WINDIR%\ime\CHTIME\9787.exe
%WINDIR%\ime\CHTIME\Applets\3336.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\1902.exe
%WINDIR%\Driver Cache\2842.exe
%WINDIR%\Driver Cache\i386\0299.exe
%WINDIR%\ehome\5482.exe
%WINDIR%\Downloaded Program Files\9442.exe
%WINDIR%\Cursors\1107.exe
%WINDIR%\Debug\3894.exe
%WINDIR%\Debug\UserMode\2431.exe
%WINDIR%\Fonts\3747.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\8538.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\5924.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\5877.exe
%WINDIR%\Help\Tours\mmTour\8404.exe
%WINDIR%\Help\7246.exe
%WINDIR%\Help\Tours\6560.exe
%WINDIR%\Help\Tours\htmlTour\8793.exe
%WINDIR%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\5690.exe
%WINDIR%\Installer\{BAF78226-3200-4DB4-BE33-4D922A799840}\7503.exe
%WINDIR%\Installer\{FE9126DB-5F84-495A-BB46-3C724F1C2D08}\7545.exe
%WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\5832.exe
%WINDIR%\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\0528.exe
%WINDIR%\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\5951.exe
%WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\6543.exe
%WINDIR%\java\4156.exe
%WINDIR%\Microsoft.NET\assembly\3960.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\8777.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\CustomMarshalers\5624.exe
%WINDIR%\Microsoft.NET\0389.exe
%WINDIR%\java\classes\7298.exe
%WINDIR%\java\trustlib\7863.exe
%WINDIR%\Media\7698.exe
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\6266.exe
%WINDIR%\ime\shared\3267.exe
%WINDIR%\ime\shared\res\0616.exe
%WINDIR%\inf\9545.exe
%WINDIR%\ime\imkr6_1\dicts\0000.exe
%WINDIR%\ime\imjp8_1\applets\7808.exe
%WINDIR%\ime\imkr6_1\5204.exe
%WINDIR%\ime\imkr6_1\applets\3983.exe
%WINDIR%\Installer\1179.exe
%WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\0880.exe
%WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\0415.exe
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\7852.exe
%WINDIR%\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\1724.exe
%WINDIR%\Installer\$PatchCache$\8465.exe
%WINDIR%\Installer\$PatchCache$\Managed\6608.exe
%WINDIR%\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\6389.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\016f9a150fce0e0a4c93532d8fa4c749\0799.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\040571d65dc822e5df020d5e084f4b45\9512.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\3555f5f74c56fa92c0ab7a635af91bfa\7863.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\8951.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\246f1a5abb686b9dcdf22d3505b08cea\3110.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\5547.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\3963e9ce8d44f50e8367e92a8e3e42e6\1696.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\7f91eecda3ff7ce478146b6458580c98\7040.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\4a518b841f06ee4f07320159cf918a2c\0852.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\2918.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\ac18c2dcd06bd2a0589bac94ccae5716\7803.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\4334.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\f5e029e2215c95ab38a1eefef7b32ac9\7701.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\4018.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\964da027ebca3b263a05cadb8eaa20a3\2651.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\0527.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\6486.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Accessibility\0118.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Accessibility\01254caa0efc15b5cd48fb3178018701\1295.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\2095.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\3523.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\a18dff8832712a0f6cccaaefbcc45861\0049.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\5527.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\AspNetMMCExt\7012.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\0851.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\2763.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\05503f37aef5261d80ccca19f8078679\8700.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\3156.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\AspNetMMCExt\03bf63d8ea6622a32b9a3fc6851801a9\3305.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\4517.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\7526.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\8334.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\17e020ae92d7fab33bcc1c98b25019d0\2468.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\0703.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\09a97525ae5583cc2685e2c39a3078bd\1510.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\3279.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\b07f0d26a34ad53fc369248f289d1126\4001.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\9770.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\e997d0200c25f7db6bd32313d50b729d\5605.exe
%WINDIR%\assembly\tmp\8888.exe
%WINDIR%\Config\2945.exe
%WINDIR%\Connection Wizard\8971.exe
%WINDIR%\assembly\temp\9041.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\0046.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\2645.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\d17606e813f01376bd0def23726ecc62\9852.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dynamic\1331ee3a7146218388537aa7e41303af\0898.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\3020.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\87a713cee613d08ee04ae9483a9d4716\3552.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\8232.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\92cccedc7cda413ff6fc6492cb256b58\1653.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\7165.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\713647b987b140a17e3c4ffe4c721f85\0018.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\1019.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\1fdd0961d8d07ef4d1fcaf30f0050c0a\7620.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing.Desi#\6892.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing.Desi#\8f9993d3eb4cd33d1452155f79b23d65\7590.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dynamic\9862.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\dd57bc19f5807c6dbe8f88d4a23277f6\2562.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Design\3603.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Design\95a46d4775428acf5dd84f12aaa9f06f\2004.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\9792.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\0140.exe
<SYSTEM32>\export\1054.exe
<SYSTEM32>\ias\5837.exe
<SYSTEM32>\icsxml\8184.exe
<SYSTEM32>\en-us\5155.exe
<DRIVERS>\4676.exe
<DRIVERS>\disdn\5394.exe
<DRIVERS>\etc\3936.exe
<SYSTEM32>\IME\4128.exe
<SYSTEM32>\Macromed\1294.exe
<SYSTEM32>\Macromed\Flash\3585.exe
<SYSTEM32>\Microsoft\2733.exe
<SYSTEM32>\inetsrv\8053.exe
<SYSTEM32>\IME\CINTLGNT\0334.exe
<SYSTEM32>\IME\PINTLGNT\8791.exe
<SYSTEM32>\IME\TINTLGNT\7197.exe
<SYSTEM32>\dllcache\4951.exe
<SYSTEM32>\config\systemprofile\SendTo\0733.exe
<SYSTEM32>\config\systemprofile\Start Menu\6942.exe
<SYSTEM32>\config\systemprofile\Start Menu\Programs\5180.exe
<SYSTEM32>\config\systemprofile\Recent\9036.exe
<SYSTEM32>\config\systemprofile\My Documents\3969.exe
<SYSTEM32>\config\systemprofile\NetHood\4550.exe
<SYSTEM32>\config\systemprofile\PrintHood\4553.exe
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\5089.exe
<SYSTEM32>\dhcp\3397.exe
<SYSTEM32>\DirectX\9890.exe
<SYSTEM32>\DirectX\Dinput\7198.exe
<SYSTEM32>\config\systemprofile\Templates\4433.exe
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\3846.exe
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Entertainment\7077.exe
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Startup\3565.exe
<SYSTEM32>\mui\0410\8093.exe
<SYSTEM32>\mui\0411\1710.exe
<SYSTEM32>\mui\0412\2703.exe
<SYSTEM32>\mui\040e\6740.exe
<SYSTEM32>\mui\040b\3771.exe
<SYSTEM32>\mui\040C\2063.exe
<SYSTEM32>\mui\040D\4633.exe
<SYSTEM32>\mui\0413\7790.exe
<SYSTEM32>\mui\0419\6112.exe
<SYSTEM32>\mui\041a\6015.exe
<SYSTEM32>\mui\041b\7618.exe
<SYSTEM32>\mui\0418\0586.exe
<SYSTEM32>\mui\0414\8225.exe
<SYSTEM32>\mui\0415\1907.exe
<SYSTEM32>\mui\0416\7777.exe
<SYSTEM32>\mui\0409\1538.exe
<SYSTEM32>\MsDtc\Trace\0177.exe
<SYSTEM32>\mui\5977.exe
<SYSTEM32>\mui\0009\0385.exe
<SYSTEM32>\MsDtc\1574.exe
<SYSTEM32>\Microsoft\Protect\7847.exe
<SYSTEM32>\Microsoft\Protect\S-1-5-18\8239.exe
<SYSTEM32>\Microsoft\Protect\S-1-5-18\User\7835.exe
<SYSTEM32>\mui\0401\6764.exe
<SYSTEM32>\mui\0406\3351.exe
<SYSTEM32>\mui\0407\3046.exe
<SYSTEM32>\mui\0408\7216.exe
<SYSTEM32>\mui\0405\0259.exe
<SYSTEM32>\mui\0402\0457.exe
<SYSTEM32>\mui\0403\3422.exe
<SYSTEM32>\mui\0404\0770.exe
<SYSTEM32>\1042\0499.exe
<SYSTEM32>\1054\4306.exe
<SYSTEM32>\2052\4040.exe
<SYSTEM32>\1041\9182.exe
<SYSTEM32>\1031\4881.exe
<SYSTEM32>\1033\0614.exe
<SYSTEM32>\1037\2516.exe
<SYSTEM32>\3076\2782.exe
<SYSTEM32>\CatRoot2\4511.exe
<SYSTEM32>\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\4476.exe
<SYSTEM32>\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2317.exe
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\4472.exe
<SYSTEM32>\3com_dmi\5661.exe
<SYSTEM32>\CatRoot\8396.exe
<SYSTEM32>\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\5645.exe
<SYSTEM32>\1028\3720.exe
%WINDIR%\SoftwareDistribution\DataStore\Logs\2609.exe
%WINDIR%\SoftwareDistribution\Download\7301.exe
%WINDIR%\SoftwareDistribution\EventCache\6400.exe
%WINDIR%\SoftwareDistribution\DataStore\2978.exe
%WINDIR%\security\logs\3258.exe
%WINDIR%\security\templates\2478.exe
%WINDIR%\SoftwareDistribution\2006.exe
%WINDIR%\SoftwareDistribution\SelfUpdate\5059.exe
%WINDIR%\system\9602.exe
<SYSTEM32>\2889.exe
<SYSTEM32>\1025\7196.exe
%WINDIR%\srchasst\mui\0409\0728.exe
%WINDIR%\srchasst\1082.exe
%WINDIR%\srchasst\chars\9926.exe
%WINDIR%\srchasst\mui\0286.exe
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\9.0\4160.exe
<SYSTEM32>\config\systemprofile\Local Settings\History\2775.exe
<SYSTEM32>\config\systemprofile\Local Settings\History\History.IE5\9942.exe
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\5171.exe
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\4572.exe
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\9317.exe
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\Media Player\1035.exe
<SYSTEM32>\config\systemprofile\Local Settings\History\History.IE5\MSHist012011111020111111\5280.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\E4T10P5J\8190.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\RK37EMDC\4071.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\W32JX7IL\2334.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6YQRA29M\5518.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temp\7387.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\4216.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6562.exe
<SYSTEM32>\config\systemprofile\Local Settings\4138.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\6234.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\0765.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Media Player\1329.exe
<SYSTEM32>\config\systemprofile\Application Data\3823.exe
<SYSTEM32>\Com\1101.exe
<SYSTEM32>\config\6786.exe
<SYSTEM32>\config\systemprofile\3486.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\4382.exe
<SYSTEM32>\config\systemprofile\Cookies\2987.exe
<SYSTEM32>\config\systemprofile\Desktop\2438.exe
<SYSTEM32>\config\systemprofile\Favorites\5078.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\3334.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\9922.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\0211.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\9576.exe
<SYSTEM32>\mui\041D\1918.exe
%WINDIR%\WinSxS\Policies\7458.exe
%WINDIR%\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1070.exe
%WINDIR%\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\8628.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\8467.exe
%WINDIR%\WinSxS\InstallTemp\6058.exe
%WINDIR%\WinSxS\Manifests\6197.exe
%WINDIR%\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\9944.exe
%WINDIR%\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\1854.exe
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\3476.exe
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\9304.exe
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\6092.exe
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\9712.exe
%WINDIR%\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\1033.exe
%WINDIR%\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\0559.exe
%WINDIR%\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\9719.exe
%WINDIR%\WinSxS\4414.exe
<SYSTEM32>\wbem\xml\5743.exe
<SYSTEM32>\wins\2022.exe
<SYSTEM32>\xircom\3802.exe
<SYSTEM32>\wbem\snmp\3337.exe
%WINDIR%\Temp\tmp1.tmp
<SYSTEM32>\wbem\Repository\4318.exe
<SYSTEM32>\wbem\Repository\FS\7428.exe
<SYSTEM32>\XPSViewer\9633.exe
%WINDIR%\Web\printers\6834.exe
%WINDIR%\Web\printers\images\6613.exe
%WINDIR%\Web\Wallpaper\9444.exe
%WINDIR%\Web\0718.exe
<SYSTEM32>\XPSViewer\en-US\9159.exe
%WINDIR%\Temp\5358.exe
%WINDIR%\twain_32\0335.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\3583.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\5423.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\8045.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\8819.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\3004.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\1247.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\6690.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\2521.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\4745.exe
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\8973.exe
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\1146.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\5320.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\5407.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\4284.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\2321.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\1844.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\0302.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\2559.exe
%WINDIR%\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\1868.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\0155.exe
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\6846.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9670.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\7850.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\6086.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\5762.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\4624.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\3699.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\3585.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\9096.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\5167.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\2880.exe
<SYSTEM32>\oobe\html\iconnect\7744.exe
<SYSTEM32>\oobe\html\ispsgnup\6740.exe
<SYSTEM32>\oobe\html\isptype\9111.exe
<SYSTEM32>\oobe\html\dslmain\4452.exe
<SYSTEM32>\oobe\actsetup\9789.exe
<SYSTEM32>\oobe\error\1943.exe
<SYSTEM32>\oobe\html\2416.exe
<SYSTEM32>\oobe\html\mouse\1527.exe
<SYSTEM32>\oobe\html\sconnect\3650.exe
<SYSTEM32>\oobe\icserror\6071.exe
<SYSTEM32>\oobe\images\3852.exe
<SYSTEM32>\oobe\html\oemreg\7545.exe
<SYSTEM32>\oobe\html\mouse\images\4983.exe
<SYSTEM32>\oobe\html\oemcust\1150.exe
<SYSTEM32>\oobe\html\oemhw\1406.exe
<SYSTEM32>\oobe\8744.exe
<SYSTEM32>\mui\0425\5659.exe
<SYSTEM32>\mui\0426\3067.exe
<SYSTEM32>\mui\0427\0375.exe
<SYSTEM32>\mui\0424\9855.exe
<SYSTEM32>\mui\041e\5543.exe
<SYSTEM32>\mui\041f\9550.exe
<SYSTEM32>\mui\0422\4957.exe
<SYSTEM32>\mui\042a\7609.exe
<SYSTEM32>\mui\0C0A\4503.exe
<SYSTEM32>\mui\dispspec\1574.exe
<SYSTEM32>\npp\2230.exe
<SYSTEM32>\mui\081a\8432.exe
<SYSTEM32>\mui\042d\3008.exe
<SYSTEM32>\mui\0804\3705.exe
<SYSTEM32>\mui\0816\9341.exe
<SYSTEM32>\spool\XPSEP\i386\9241.exe
<SYSTEM32>\spool\XPSEP\i386\i386\8907.exe
<SYSTEM32>\URTTEMP\0010.exe
<SYSTEM32>\spool\XPSEP\amd64\amd64\5176.exe
<SYSTEM32>\spool\prtprocs\x64\4132.exe
<SYSTEM32>\spool\XPSEP\6171.exe
<SYSTEM32>\spool\XPSEP\amd64\3946.exe
<SYSTEM32>\usmt\2070.exe
<SYSTEM32>\wbem\mof\bad\3077.exe
<SYSTEM32>\wbem\mof\good\2639.exe
<SYSTEM32>\wbem\Performance\4687.exe
<SYSTEM32>\wbem\mof\6279.exe
<SYSTEM32>\wbem\3695.exe
<SYSTEM32>\wbem\AutoRecover\6544.exe
<SYSTEM32>\wbem\Logs\4182.exe
<SYSTEM32>\spool\prtprocs\w32x86\6915.exe
<SYSTEM32>\ras\2132.exe
<SYSTEM32>\Restore\7016.exe
<SYSTEM32>\Setup\0602.exe
<SYSTEM32>\oobe\setup\9531.exe
<SYSTEM32>\oobe\isperror\2456.exe
<SYSTEM32>\oobe\regerror\3222.exe
<SYSTEM32>\oobe\sample\0169.exe
<SYSTEM32>\ShellExt\1467.exe
<SYSTEM32>\spool\drivers\w32x86\3\8585.exe
<SYSTEM32>\spool\PRINTERS\3507.exe
<SYSTEM32>\spool\prtprocs\9153.exe
<SYSTEM32>\spool\drivers\w32x86\5236.exe
<SYSTEM32>\spool\5720.exe
<SYSTEM32>\spool\drivers\1211.exe
<SYSTEM32>\spool\drivers\color\1942.exe
%WINDIR%\security\Database\1725.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\9366.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\9853.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\8453.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\App_LocalResources\2470.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\8397.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\6449.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\0824.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\9727.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\1991.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\Browsers\4524.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MOF\7118.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\9144.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\0431.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\9648.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\8329.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\5672.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults\5887.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults\preferences\6706.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\9093.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\chrome\4362.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\SQL\EN\7748.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\8085.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\2630.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\1033\8733.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Data\7819.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_GlobalResources\0310.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\1112.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\7983.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\8011.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\6517.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\8135.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\3089.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\5192.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\3378.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\1727.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\6248.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\3100.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\8437.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\9217.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\8126.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\6901.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Client\8257.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\0815.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\5675.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\2030.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\2030.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\6965.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\0159.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\4129.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\3616.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\1640.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild\5550.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\9408.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\0409\6692.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\0036.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\3393.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\0132.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\1277.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\9183.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\7402.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\1960.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\6564.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\1219.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\5828.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\0148.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data\5687.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\4503.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\3244.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\8745.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\5073.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\5465.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\5609.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\2714.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\0037.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\0082.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\2258.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\5444.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\4121.exe
%WINDIR%\Microsoft.NET\Framework\v1.0.3705\9783.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\9996.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\9373.exe
%WINDIR%\Microsoft.NET\Framework\2289.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\7110.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask\0626.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask\v4.0_4.0.0.0__31bf3856ad364e35\3755.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\0675.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\4224.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\7997.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\1033\8523.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\4859.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\6381.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MUI\8426.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MUI\0409\6494.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\EN\3453.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\1052.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\en-US\2768.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\4816.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\MUI\6644.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\MUI\0409\4875.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\4714.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\5025.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\MOF\6151.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild\1711.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\SQL\6270.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\9423.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\5892.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\1033\5550.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\5070.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\2305.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\5636.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\8374.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild\2337.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\3553.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\9692.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\9501.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\6937.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MUI\7736.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\7758.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\9109.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\4941.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\2026.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MUI\0409\8713.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RedistList\4016.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\SubsetList\4628.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Graphics\6455.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\6974.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Css\6427.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\1345.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\0270.exe
%WINDIR%\pchealth\helpctr\System\panels\5627.exe
%WINDIR%\pchealth\helpctr\System\panels\subpanels\9539.exe
%WINDIR%\pchealth\helpctr\System\rc\6720.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\6451.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\3851.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\1659.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\5968.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\5889.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\4412.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\6501.exe
%WINDIR%\pchealth\helpctr\System\scripts\3307.exe
%WINDIR%\pchealth\helpctr\System\NetDiag\1847.exe
%WINDIR%\pchealth\helpctr\System\dialogs\3644.exe
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\0254.exe
%WINDIR%\pchealth\helpctr\System\ErrMsg\3955.exe
%WINDIR%\pchealth\helpctr\System\DFS\1551.exe
%WINDIR%\pchealth\helpctr\System\blurbs\3609.exe
%WINDIR%\pchealth\helpctr\System\CompatCtr\5601.exe
%WINDIR%\pchealth\helpctr\System\css\1157.exe
%WINDIR%\pchealth\helpctr\System\errors\9899.exe
%WINDIR%\pchealth\helpctr\System\images\48x48\4111.exe
%WINDIR%\pchealth\helpctr\System\images\Centers\9059.exe
%WINDIR%\pchealth\helpctr\System\images\Expando\3558.exe
%WINDIR%\pchealth\helpctr\System\images\32x32\6159.exe
%WINDIR%\pchealth\helpctr\System\images\9147.exe
%WINDIR%\pchealth\helpctr\System\images\16x16\2504.exe
%WINDIR%\pchealth\helpctr\System\images\24x24\2996.exe
%WINDIR%\Registration\0381.exe
%WINDIR%\Registration\CRMLog\7969.exe
%WINDIR%\repair\1987.exe
%WINDIR%\pss\8804.exe
%WINDIR%\Prefetch\4612.exe
%WINDIR%\Provisioning\9089.exe
%WINDIR%\Provisioning\Schemas\3624.exe
%WINDIR%\Resources\5241.exe
%WINDIR%\Resources\Themes\Luna\Shell\Metallic\9547.exe
%WINDIR%\Resources\Themes\Luna\Shell\NormalColor\8599.exe
%WINDIR%\security\6244.exe
%WINDIR%\Resources\Themes\Luna\Shell\Homestead\5217.exe
%WINDIR%\Resources\Themes\4511.exe
%WINDIR%\Resources\Themes\Luna\0938.exe
%WINDIR%\Resources\Themes\Luna\Shell\0981.exe
%WINDIR%\PeerNet\7389.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\4856.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\9712.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\3899.exe
%WINDIR%\pchealth\helpctr\Vendors\2177.exe
%WINDIR%\pchealth\helpctr\System\UpdateCtr\2674.exe
%WINDIR%\pchealth\helpctr\System_OEM\0405.exe
%WINDIR%\pchealth\helpctr\Temp\8705.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\2771.exe
%WINDIR%\pchealth\UploadLB\1245.exe
%WINDIR%\pchealth\UploadLB\Binaries\6894.exe
%WINDIR%\pchealth\UploadLB\Config\6179.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\1798.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\1179.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\3457.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\7896.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\5196.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\0285.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\2451.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\1909.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\5137.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\6463.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\9495.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\9118.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SQL\2129.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SQL\en\6485.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\2198.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Graphics\8035.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\9628.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\8792.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Extended\2740.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\2463.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\3130.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\7811.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\2273.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\6435.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\8251.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\0304.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\5537.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\1466.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\0928.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\4457.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\2354.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\9601.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\6510.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\3617.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\3279.exe
%WINDIR%\pchealth\helpctr\Config\CheckPoint\7621.exe
%WINDIR%\pchealth\helpctr\Database\4385.exe
%WINDIR%\pchealth\helpctr\DataColl\1218.exe
%WINDIR%\pchealth\helpctr\Config\Cache\9168.exe
%WINDIR%\pchealth\helpctr\BATCH\1476.exe
%WINDIR%\pchealth\helpctr\binaries\7611.exe
%WINDIR%\pchealth\helpctr\Config\7943.exe
%WINDIR%\pchealth\helpctr\HelpFiles\4360.exe
%WINDIR%\pchealth\helpctr\OfflineCache\Professional_32#0409\5036.exe
%WINDIR%\pchealth\helpctr\PackageStore\2482.exe
%WINDIR%\pchealth\helpctr\System\0723.exe
%WINDIR%\pchealth\helpctr\OfflineCache\6511.exe
%WINDIR%\pchealth\helpctr\Indices\9146.exe
%WINDIR%\pchealth\helpctr\InstalledSKUs\1436.exe
%WINDIR%\pchealth\helpctr\Logs\9511.exe
%WINDIR%\pchealth\helpctr\7600.exe
%WINDIR%\msagent\chars\3082.exe
%WINDIR%\msagent\intl\8547.exe
%WINDIR%\msapps\6934.exe
%WINDIR%\msagent\0088.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\9677.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\en-US\6066.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\6380.exe
%WINDIR%\msapps\msinfo\3509.exe
%WINDIR%\pchealth\ERRORREP\8981.exe
%WINDIR%\pchealth\ERRORREP\QHEADLES\2665.exe
%WINDIR%\pchealth\ERRORREP\QSIGNOFF\6822.exe
%WINDIR%\pchealth\3068.exe
%WINDIR%\mui\9867.exe
%WINDIR%\ocx\5813.exe
%WINDIR%\Offline Web Pages\3588.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\6088.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\6033.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\6854.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\3153.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\2838.exe
%CommonProgramFiles%\Microsoft Shared\VGX\4178.exe
%CommonProgramFiles%\Microsoft Shared\Web Folders\7406.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\3768.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\7048.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\1311.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\5777.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\6143.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\4318.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\8699.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\5005.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\4546.exe
%CommonProgramFiles%\Microsoft Shared\VC\0977.exe
%CommonProgramFiles%\Microsoft Shared\DW\1040\8192.exe
%CommonProgramFiles%\Microsoft Shared\DW\1041\9540.exe
%CommonProgramFiles%\Microsoft Shared\DW\1042\0082.exe
%CommonProgramFiles%\Microsoft Shared\DW\1036\2471.exe
%CommonProgramFiles%\Microsoft Shared\DW\1028\6796.exe
%CommonProgramFiles%\Microsoft Shared\DW\1031\1662.exe
%CommonProgramFiles%\Microsoft Shared\DW\1033\8998.exe
%CommonProgramFiles%\Microsoft Shared\DW\2052\2859.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\5423.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\1670.exe
%CommonProgramFiles%\Microsoft Shared\Triedit\2362.exe
%CommonProgramFiles%\Microsoft Shared\Speech\1033\7119.exe
%CommonProgramFiles%\Microsoft Shared\DW\3082\2897.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\7999.exe
%CommonProgramFiles%\Microsoft Shared\Speech\5086.exe
%CommonProgramFiles%\System\Ole DB\0194.exe
%PROGRAM_FILES%\ComPlus Applications\4349.exe
%PROGRAM_FILES%\FireFox\2993.exe
%CommonProgramFiles%\System\msadc\3699.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\2194.exe
%CommonProgramFiles%\System\0988.exe
%CommonProgramFiles%\System\ado\0935.exe
%PROGRAM_FILES%\FireFox\chrome\2250.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\5560.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\9349.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\2065.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\3340.exe
%PROGRAM_FILES%\FireFox\chrome\browser\0195.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\3956.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\branding\8345.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\6058.exe
%CommonProgramFiles%\MSSoap\9962.exe
%CommonProgramFiles%\MSSoap\Binaries\5927.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\1270.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\0099.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\2723.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\3141.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\4125.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\7445.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\7666.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\6472.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\8479.exe
%CommonProgramFiles%\SpeechEngines\9873.exe
%CommonProgramFiles%\ODBC\1695.exe
%CommonProgramFiles%\ODBC\Data Sources\0465.exe
%CommonProgramFiles%\Services\9762.exe
C:\Far2\Plugins\FileCase\9000.exe
C:\Far2\Plugins\FTP\9354.exe
C:\Far2\Plugins\FTP\lib\4368.exe
C:\Far2\Plugins\FarCmds\5550.exe
C:\Far2\Plugins\ExtSearch\keys\5843.exe
C:\Far2\Plugins\ExtSearch\sources\0032.exe
C:\Far2\Plugins\ExtSearch\sources\RegExp\7982.exe
C:\Far2\Plugins\HlfViewer\8927.exe
C:\Far2\Plugins\WinSCP\2831.exe
C:\Far2\Plugins\WinSCP\components\5459.exe
C:\Far2\Plugins\WinSCP\console\4678.exe
C:\Far2\Plugins\TmpPanel\7973.exe
C:\Far2\Plugins\MacroView\2761.exe
C:\Far2\Plugins\Network\5788.exe
C:\Far2\Plugins\ProcList\2924.exe
C:\Far2\Plugins\ExtSearch\doc\0115.exe
C:\Far2\Plugins\Colorer\hrc\8333.exe
C:\Far2\Plugins\Colorer\hrc\auto\3544.exe
C:\Far2\Plugins\Colorer\hrc\auto\types\6074.exe
C:\Far2\Plugins\Colorer\bin\1618.exe
C:\Far2\Plugins\AutoWrap\3664.exe
C:\Far2\Plugins\Brackets\6476.exe
C:\Far2\Plugins\Colorer\9204.exe
C:\Far2\Plugins\Colorer\hrd\8323.exe
C:\Far2\Plugins\EditCase\6319.exe
C:\Far2\Plugins\EMenu\6652.exe
C:\Far2\Plugins\ExtSearch\8392.exe
C:\Far2\Plugins\DrawLine\5527.exe
C:\Far2\Plugins\Colorer\hrd\console\9512.exe
C:\Far2\Plugins\Colorer\hrd\console\contrib\0874.exe
C:\Far2\Plugins\Compare\2729.exe
C:\Far2\Plugins\WinSCP\windows\1193.exe
C:\Far2\PluginSDK\1757.exe
C:\Far2\PluginSDK\Headers.c\8751.exe
C:\Far2\Plugins\WinSCP\resource\4912.exe
C:\Far2\Plugins\WinSCP\putty\charset\6696.exe
C:\Far2\Plugins\WinSCP\putty\windows\5436.exe
C:\Far2\Plugins\WinSCP\release\9610.exe
C:\Far2\PluginSDK\Headers.pas\8475.exe
%CommonProgramFiles%\Microsoft Shared\DAO\5823.exe
%CommonProgramFiles%\Microsoft Shared\DW\9654.exe
%CommonProgramFiles%\Microsoft Shared\DW\1025\3157.exe
%CommonProgramFiles%\Microsoft Shared\5424.exe
<Auxiliary element>
%PROGRAM_FILES%\4169.exe
%CommonProgramFiles%\3106.exe
C:\Far2\Plugins\WinSCP\putty\1803.exe
C:\Far2\Plugins\WinSCP\filezilla\5883.exe
C:\Far2\Plugins\WinSCP\filezilla\misc\2834.exe
C:\Far2\Plugins\WinSCP\forms\9246.exe
C:\Far2\Plugins\WinSCP\fari\2994.exe
C:\Far2\Plugins\WinSCP\core\5821.exe
C:\Far2\Plugins\WinSCP\dragext\9860.exe
C:\Far2\Plugins\WinSCP\far\3262.exe
C:\Far2\Plugins\WinSCP\lib\0901.exe
C:\Far2\Plugins\WinSCP\packages\tb2k\1483.exe
C:\Far2\Plugins\WinSCP\packages\tbx\9262.exe
C:\Far2\Plugins\WinSCP\packages\theme\9685.exe
C:\Far2\Plugins\WinSCP\packages\my\8687.exe
C:\Far2\Plugins\WinSCP\packages\0421.exe
C:\Far2\Plugins\WinSCP\packages\dragndrop\0929.exe
C:\Far2\Plugins\WinSCP\packages\filemng\9322.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\8778.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\3230.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\9473.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\6184.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\5751.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\8378.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\7748.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\4270.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\preferences\0583.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\satchel\3962.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\xbl-marquee\0411.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\6078.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\passwordmgr\9327.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\profile\2619.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\update\9970.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\7164.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\5576.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\services\1598.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\feedback\1451.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\8284.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\places\7590.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\passwordmgr\2531.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pipnss\2503.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pippki\2818.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\0401.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\8272.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\alerts\4644.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\6631.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\cookie\4602.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\pippki\3592.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\8734.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\0024.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\handling\9625.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\0184.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\8995.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\5230.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\2000.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\7425.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\9733.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\9162.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\0507.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\alerts\3213.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\3634.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\6248.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\5827.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\2835.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\viewsource\8781.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\3079.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\alerts\4637.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\9535.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\1395.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\8986.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\7432.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\6262.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\2593.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\0905.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\8831.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\1213.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\8577.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\8086.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\3623.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\7055.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\8433.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\6725.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\9321.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\7704.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\5942.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\6179.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\0337.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\8280.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\5300.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\1475.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\7767.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\8014.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\3420.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\6637.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\7511.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\0809.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\0630.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\1062.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\0850.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\3536.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\6487.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\5842.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\0613.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\8171.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\2377.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\4426.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\9146.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\9816.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\7539.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\9139.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\2357.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\6681.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-region\1245.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\2307.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\0689.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\win\1776.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\8146.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\2128.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\9112.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\8113.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\update\1728.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\4450.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\necko\5642.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\1214.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\3368.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\1467.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\0139.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\2715.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\4890.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\0944.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\3969.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\1917.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\9223.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\5770.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\6618.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\8388.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\2875.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\7898.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\2195.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\4182.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\3764.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\9337.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\3623.exe
C:\Far2\Plugins\arclite\6277.exe
C:\Documents and Settings\Default User\Templates\3042.exe
C:\Documents and Settings\LocalService\3004.exe
C:\Documents and Settings\LocalService\Application Data\6830.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\5812.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\6328.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\6902.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\7333.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\7589.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\5768.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\4688.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\0394.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\9781.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\0387.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\1529.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\8522.exe
C:\Documents and Settings\Default User\Start Menu\Programs\9476.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\3635.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\1747.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\0342.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\7681.exe
C:\Documents and Settings\Default User\Local Settings\History\8725.exe
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\4684.exe
C:\Documents and Settings\Default User\Local Settings\Temp\3559.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\7657.exe
C:\Documents and Settings\Default User\Recent\6266.exe
C:\Documents and Settings\Default User\SendTo\6315.exe
C:\Documents and Settings\Default User\Start Menu\7294.exe
C:\Documents and Settings\Default User\PrintHood\2467.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\9494.exe
C:\Documents and Settings\Default User\My Documents\3345.exe
C:\Documents and Settings\Default User\NetHood\7854.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\4754.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\5918.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\8019.exe
C:\Documents and Settings\NetworkService\Application Data\8432.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\0432.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\8458.exe
C:\Documents and Settings\NetworkService\7427.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\0029.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\1105.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\8534.exe
C:\Documents and Settings\NetworkService\Cookies\9160.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\3209.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\0938.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\9848.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\7742.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\9686.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\2580.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\2573.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\0420.exe
C:\Documents and Settings\LocalService\Local Settings\0477.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\0897.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\7264.exe
C:\Documents and Settings\LocalService\Cookies\8178.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\8267.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\8160.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\5940.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\8579.exe
C:\Documents and Settings\LocalService\Local Settings\Temp\4627.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\2609.exe
C:\Documents and Settings\LocalService\Local Settings\History\2783.exe
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\0758.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\3036.exe
%ALLUSERSPROFILE%\Desktop\7467.exe
%ALLUSERSPROFILE%\Documents\5554.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\6551.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\8872.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\8178.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\4994.exe
%ALLUSERSPROFILE%\Documents\My Music\7187.exe
%ALLUSERSPROFILE%\Documents\My Pictures\9372.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\2743.exe
%ALLUSERSPROFILE%\Documents\My Videos\0140.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\5860.exe
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\1982.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\5112.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0283.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\4864.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\3991.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\6489.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\5638.exe
%ALLUSERSPROFILE%\Application Data\3759.exe
<Current directory>\4668.exe
C:\Documents and Settings\3521.exe
%ALLUSERSPROFILE%\1021.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\7000.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\1115.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\3068.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\0010.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\2093.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\3246.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\6411.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\4031.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\6325.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\1696.exe
C:\Documents and Settings\Default User\Cookies\1279.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\4213.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\5136.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\7306.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\5385.exe
C:\Documents and Settings\Default User\Desktop\4717.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\3586.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\6838.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\7189.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\8722.exe
C:\Documents and Settings\Default User\Favorites\0638.exe
C:\Documents and Settings\Default User\Local Settings\5622.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\8790.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\4679.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\1347.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\3990.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\6714.exe
%ALLUSERSPROFILE%\Start Menu\Programs\2226.exe
%ALLUSERSPROFILE%\DRM\1677.exe
%ALLUSERSPROFILE%\Favorites\6410.exe
%ALLUSERSPROFILE%\Start Menu\7376.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\8930.exe
C:\Documents and Settings\Default User\0198.exe
C:\Documents and Settings\Default User\Application Data\9173.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\8350.exe
%ALLUSERSPROFILE%\Templates\9384.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\2638.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\8464.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Games\6991.exe
C:\Documents and Settings\NetworkService\Local Settings\6502.exe
%HOMEPATH%\Local Settings\History\History.IE5\2382.exe
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\1625.exe
%TEMP%\2042.exe
%HOMEPATH%\Local Settings\History\6008.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\5972.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\5231.exe
<LS_APPDATA>\VMware\0179.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\0458.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\1345.exe
%HOMEPATH%\My Documents\1930.exe
%HOMEPATH%\My Documents\Downloads\6643.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\0946.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\4867.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\5674.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\0102.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\1891.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\4147.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\3556.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\1935.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\1353.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9591.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\6427.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\1331.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\7905.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\1746.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\8411.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\6477.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\6220.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\9149.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\8916.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\6995.exe
C:\Far2\Addons\Shell\3114.exe
C:\Far2\Addons\XLat\7103.exe
C:\Far2\Addons\XLat\Russian\6289.exe
C:\Far2\Addons\SetUp\4199.exe
C:\Far2\Addons\Colors\Custom Highlighting\1797.exe
C:\Far2\Addons\Colors\Default Highlighting\5837.exe
C:\Far2\Addons\Macros\5017.exe
C:\Far2\Documentation\8856.exe
C:\Far2\Plugins\5759.exe
C:\Far2\Plugins\7-Zip\6233.exe
C:\Far2\Plugins\Align\8736.exe
C:\Far2\FExcept\1871.exe
C:\Far2\Documentation\eng\0922.exe
C:\Far2\Documentation\rus\8390.exe
C:\Far2\Encyclopedia\5634.exe
C:\Far2\Addons\Colors\3200.exe
%HOMEPATH%\PrintHood\3169.exe
%HOMEPATH%\Recent\3565.exe
%HOMEPATH%\SendTo\1394.exe
%HOMEPATH%\NetHood\1501.exe
%HOMEPATH%\My Documents\My Music\6527.exe
%HOMEPATH%\My Documents\My Pictures\5395.exe
%HOMEPATH%\My Documents\My Received Files\1273.exe
%HOMEPATH%\Start Menu\0399.exe
%HOMEPATH%\Templates\2565.exe
C:\Far2\3383.exe
C:\Far2\Addons\5279.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\6558.exe
%HOMEPATH%\Start Menu\Programs\4849.exe
%HOMEPATH%\Start Menu\Programs\Accessories\2641.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\4829.exe
%APPDATA%\Microsoft\Credentials\4312.exe
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\6024.exe
%APPDATA%\Microsoft\Internet Explorer\9498.exe
%APPDATA%\Microsoft\Address Book\8873.exe
%APPDATA%\Identities\6176.exe
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\3552.exe
%APPDATA%\Microsoft\0207.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\4749.exe
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\3223.exe
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\4007.exe
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\2149.exe
%APPDATA%\Microsoft\SystemCertificates\My\2869.exe
%APPDATA%\Microsoft\Media Player\7205.exe
%APPDATA%\Microsoft\MMC\9163.exe
%APPDATA%\Microsoft\SystemCertificates\9507.exe
%APPDATA%\9298.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\8822.exe
C:\Documents and Settings\NetworkService\Local Settings\History\1578.exe
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\0304.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\0960.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\0902.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\6709.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\6430.exe
C:\Documents and Settings\NetworkService\Local Settings\Temp\6333.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\2136.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\6846.exe
%HOMEPATH%\0174.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\1914.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\6501.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0087.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\3018.exe
<LS_APPDATA>\Microsoft\CD Burning\0036.exe
<LS_APPDATA>\Microsoft\Credentials\9717.exe
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\6259.exe
<LS_APPDATA>\Microsoft\7276.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\5506.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\5386.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\1494.exe
<LS_APPDATA>\Microsoft\Media Player\2948.exe
<LS_APPDATA>\Mozilla\Firefox\6717.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\4399.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\6250.exe
<LS_APPDATA>\Mozilla\3892.exe
<LS_APPDATA>\Microsoft\Windows\5860.exe
<LS_APPDATA>\Microsoft\Windows Media\1722.exe
<LS_APPDATA>\Microsoft\Windows Media\9.0\5828.exe
<LS_APPDATA>\Identities\4243.exe
%APPDATA%\Mozilla\Firefox\3411.exe
%APPDATA%\Mozilla\Firefox\Profiles\9918.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\8155.exe
%APPDATA%\Mozilla\Extensions\6909.exe
%APPDATA%\Microsoft\Windows\4993.exe
%APPDATA%\Microsoft\Windows\Themes\7605.exe
%APPDATA%\Mozilla\8390.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\9947.exe
%HOMEPATH%\Favorites\Links\0313.exe
%HOMEPATH%\Local Settings\1748.exe
<LS_APPDATA>\4444.exe
%HOMEPATH%\Favorites\0137.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\1432.exe
%HOMEPATH%\Cookies\4185.exe
%HOMEPATH%\Desktop\2661.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\checkbox\3016.exe
%WINDIR%\assembly\GAC_MSIL\System.Management\1819.exe
%WINDIR%\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\7466.exe
%WINDIR%\assembly\GAC_MSIL\System.Management.Instrumentation\5653.exe
%WINDIR%\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\5555.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel.Selectors\5042.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\3256.exe
%WINDIR%\assembly\GAC_MSIL\System.IO.Log\1242.exe
%WINDIR%\assembly\GAC_MSIL\System.Management.Instrumentation\3.5.0.0__b77a5c561934e089\7416.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Remoting\3050.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\2545.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization\1129.exe
%WINDIR%\assembly\GAC_MSIL\System.Net\3.5.0.0__b03f5f7f11d50a3a\3908.exe
%WINDIR%\assembly\GAC_MSIL\System.Messaging\8422.exe
%WINDIR%\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\4194.exe
%WINDIR%\assembly\GAC_MSIL\System.Net\3836.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\7664.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices\5051.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\4071.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\6662.exe
%WINDIR%\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\8315.exe
%WINDIR%\assembly\GAC_MSIL\System.Deployment\4533.exe
%WINDIR%\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\9661.exe
%WINDIR%\assembly\GAC_MSIL\System.Design\4390.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\0167.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing.Design\3152.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\1126.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel\6192.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\3674.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.Protocols\8351.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\4468.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing\8900.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData\3.5.0.0__31bf3856ad364e35\7683.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData.Design\5280.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35\7704.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData\5687.exe
%WINDIR%\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\0551.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Abstractions\8754.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Abstractions\3.5.0.0__31bf3856ad364e35\9019.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity\8859.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\7363.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions.Design\0307.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\4355.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions\2796.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity\3.5.0.0__b77a5c561934e089\8644.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity.Design\8905.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity.Design\3.5.0.0__b77a5c561934e089\4867.exe
%WINDIR%\assembly\GAC_MSIL\System.Speech\7494.exe
%WINDIR%\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\7408.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel\5799.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\7271.exe
%WINDIR%\assembly\GAC_MSIL\System.Security\5076.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\0525.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\8629.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\8652.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Install\7112.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\0260.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceProcess\4927.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\7645.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Web\1635.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\0644.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.WasHosting\5047.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\9016.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Royale\9825.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\9725.exe
%WINDIR%\assembly\GAC_MSIL\PresentationUI\1353.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\6216.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Classic\3775.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\4573.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Luna\9905.exe
%WINDIR%\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\5928.exe
%WINDIR%\assembly\GAC_MSIL\SMDiagnostics\7387.exe
%WINDIR%\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\7104.exe
%WINDIR%\assembly\GAC_MSIL\sysglobl\2344.exe
%WINDIR%\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\4471.exe
%WINDIR%\assembly\GAC_MSIL\ReachFramework\1198.exe
%WINDIR%\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\6211.exe
%WINDIR%\assembly\GAC_MSIL\Sentinel.v3.5Client\6172.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\9069.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft_VsaVb\4641.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\7312.exe
%WINDIR%\assembly\GAC_MSIL\PresentationBuildTasks\7192.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\9634.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa\3827.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\7373.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\1256.exe
%WINDIR%\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\5060.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework\3256.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\6356.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Aero\2398.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\2036.exe
%WINDIR%\assembly\GAC_MSIL\PresentationCFFRasterizer\3248.exe
%WINDIR%\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\5799.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\7297.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\9480.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Linq\2256.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\5972.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity.Design\0955.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\8316.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity\5307.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity\3.5.0.0__b77a5c561934e089\8244.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services\4613.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Design\3.5.0.0__b77a5c561934e089\2127.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.SqlXml\4439.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\7202.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Design\5472.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services\3.5.0.0__b77a5c561934e089\0595.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Client\5083.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Client\3.5.0.0__b77a5c561934e089\2210.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.DataSetExtensions\7755.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\0889.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn.Contract\0312.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\4294.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn\3315.exe
%WINDIR%\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\5500.exe
%WINDIR%\assembly\GAC_MSIL\System\7504.exe
%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\0775.exe
%WINDIR%\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\6341.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\4457.exe
%WINDIR%\assembly\GAC_MSIL\System.Core\3890.exe
%WINDIR%\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\7439.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration.Install\0151.exe
%WINDIR%\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\5138.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration\3790.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\9529.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Mobile\8688.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\8739.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5b3d048d8c003d743ea5e72caf07773a\7180.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\4027.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\539e297cc9bc67fbf2fbdc9dc5fcd0f1\6758.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\7d61e63dea85f4f77ea4c13df7651ec7\0568.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\4692.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\21bb6244c91b6207fbcb038884a641ef\3891.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\f0e9a97ade4529d4caeccd467aa8e7db\1463.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\2748.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\4765.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\0207.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\8568.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\7174.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\28ea74096df47800fe2c78bb2b9a4f2a\9621.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\6005.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\9911.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\ce984d7bbd9a6d5d3cca28c4e5038020\7286.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\daf5ff5e06c80eefa80c6fcc79aec963\9534.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\1707.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\6697.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\2010.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\8253.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\c5c4db4f9bc7a454e9cfc2548a9d45a5\5851.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\36dbc4689f7c51e393504230004c9dec\6293.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\4983.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\28eede53267524df58362a75a668cf86\1099.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\43dceeb2d0601d79af40752fb20283c2\1036.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\cd6eeb3d7ea1f65c28a43e665db38644\1492.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\66359457e427c0d547750a79f754f9ba\7773.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\5693.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\152cf75db013f0523933ac45177b4217\7785.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\2e19ccefc30d7b827bab3f7d8dcc0ab9\6157.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\4539.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\2306.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\2630.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ReachFramework\5c59991df60164cae10fd81b88a8e5b1\9916.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\7583.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\2395.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\sysglobl\8970.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn\b01721205312c6c18df033cc47b60e5c\7382.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\2230.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\f2b48eab657b4ef1d19dac11bdf0c913\7044.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn\5218.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\sysglobl\6e07cc846884a853b910775fcec87ced\9324.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\2544.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\8377.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ReachFramework\6800.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCore\12dcb10b76012416357bdbb010fdaa97\2386.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\2919.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\6683.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCore\8390.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\b6bfb51dec7f8cc42c21c5928470c773\4081.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\3594.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\487c1bc20f6e73e8e79503898d17d102\5294.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\6888.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ef1a93d10c3a91b728745dbfcc79c2c7\9065.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationUI\2881.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationUI\87fb973e4ab6a21fd00e45656fa7c115\8364.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\b4dc4bd8534d90fbb7430926ad990cd9\2098.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\79c2fd29b1e46c943960278051b4e1b9\8150.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\9519494798a88867406b5755e1dbded6\1068.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\9e71fd0d299c5668c96a54e4a63479fa\4954.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\7224.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml.Linq\8963.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\8724.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml\1940.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\2439.exe
%WINDIR%\assembly\GAC_MSIL\System.WorkflowServices\9381.exe
%WINDIR%\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\3950.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClient\3331.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\2683.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationTypes\7405.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\3925.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationProvider\2940.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\5421.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClientsideProviders\0227.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\2436.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Runtime\0296.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\8908.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Services\9429.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\2174.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Routing\5113.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\6617.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.RegularExpressions\7127.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\0177.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\0853.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\7258.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.ComponentModel\3283.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\4916.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Activities\8758.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\2582.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Presentation\8901.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Presentation\3.5.0.0__b77a5c561934e089\0939.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_f236c56a\3071.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\7451.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Accessibility\1475.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Xml\6867.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_7cac80ba\4103.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1945.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_353815cd\4331.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Accessibility\c2af7cfbb47c077029a2645930b4eeac\3513.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\5083.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\e148983beeb0f30918b0564849a16456\6336.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\8641.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\9001.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\6768.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\c7ffd8c23e8de4018a88185b3b60631e\9752.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\3170.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\3864.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\8241.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\CustomMarshalers\2910.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_b50667e9\6025.exe
%WINDIR%\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\1467.exe
%WINDIR%\assembly\GAC_MSIL\WindowsBase\1646.exe
%WINDIR%\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\0942.exe
%WINDIR%\assembly\GAC_MSIL\WindowsFormsIntegration\8686.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\mscorlib\5111.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_cd264933\6448.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing\6360.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_c34133cb\9524.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Design\5899.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_5917eb5b\6643.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System\4461.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_27b9fd4f\9660.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\6952.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\4631.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\8705.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\3696.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\4465.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\2713.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\1792.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\5074.exe
%PROGRAM_FILES%\Uninstall Information\9865.exe
%PROGRAM_FILES%\Windows Media Player\Visualizations\9258.exe
%PROGRAM_FILES%\Windows NT\1691.exe
%PROGRAM_FILES%\Windows NT\Accessories\5648.exe
%PROGRAM_FILES%\Windows Media Player\Skins\2291.exe
%PROGRAM_FILES%\Windows Media Player\4169.exe
%PROGRAM_FILES%\Windows Media Player\Icons\1231.exe
%PROGRAM_FILES%\Windows Media Player\Sample Playlists\7252.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\1095.exe
%PROGRAM_FILES%\MSN\9946.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\9753.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\5378.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\6359.exe
%PROGRAM_FILES%\MSBuild\Microsoft\6634.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\2750.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\5501.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\9997.exe
%PROGRAM_FILES%\Online Services\2475.exe
%PROGRAM_FILES%\Outlook Express\2303.exe
%PROGRAM_FILES%\Reference Assemblies\3695.exe
%PROGRAM_FILES%\NetMeeting\2923.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\OOBE\1197.exe
%PROGRAM_FILES%\MSN Gaming Zone\1401.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\6498.exe
%WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\1576.exe
%WINDIR%\assembly\GAC\IEExecRemote\5668.exe
%WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\6453.exe
%WINDIR%\assembly\GAC\CustomMarshalers\2084.exe
%WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\1357.exe
%WINDIR%\assembly\GAC\cscompmgd\6245.exe
%WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\9617.exe
%WINDIR%\assembly\GAC\IEHost\7541.exe
%WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\5217.exe
%WINDIR%\assembly\GAC\Microsoft.JScript\9445.exe
%WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\8441.exe
%WINDIR%\assembly\GAC\ISymWrapper\1627.exe
%WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\7071.exe
%WINDIR%\assembly\GAC\IIEHost\1072.exe
%WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\7321.exe
%WINDIR%\assembly\GAC\Accessibility\7277.exe
C:\RECYCLER\9364.exe
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\5393.exe
%WINDIR%\7476.exe
%PROGRAM_FILES%\xerox\nwwia\5959.exe
%PROGRAM_FILES%\Windows NT\Pinball\5066.exe
%PROGRAM_FILES%\WindowsUpdate\6074.exe
%PROGRAM_FILES%\xerox\9886.exe
%WINDIR%\$NtUninstallKB942288-v3$\0828.exe
%WINDIR%\AppPatch\3620.exe
%WINDIR%\assembly\2103.exe
%WINDIR%\assembly\GAC\4532.exe
%WINDIR%\addins\5877.exe
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\8647.exe
%WINDIR%\$NtUninstallWIC$\8584.exe
%WINDIR%\$NtUninstallWIC$\spuninst\1182.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\5600.exe
%PROGRAM_FILES%\FireFox\components\3716.exe
%PROGRAM_FILES%\FireFox\defaults\6407.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\viewsource\5471.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\1841.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\9039.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\update\4134.exe
%PROGRAM_FILES%\FireFox\defaults\autoconfig\8637.exe
%PROGRAM_FILES%\FireFox\extensions\4230.exe
%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\0951.exe
%PROGRAM_FILES%\FireFox\modules\4593.exe
%PROGRAM_FILES%\FireFox\dictionaries\9238.exe
%PROGRAM_FILES%\FireFox\defaults\pref\0186.exe
%PROGRAM_FILES%\FireFox\defaults\profile\3483.exe
%PROGRAM_FILES%\FireFox\defaults\profile\chrome\7125.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\places\8176.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\printpreview\8124.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\radio\7857.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\6849.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\media\6082.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\console\3592.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\dirListing\1747.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\icons\6362.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\splitter\8078.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\8413.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\handling\9650.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\1038.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\0447.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\toolbar\6673.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\tree\7825.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\3260.exe
%PROGRAM_FILES%\microsoft frontpage\9048.exe
%PROGRAM_FILES%\microsoft frontpage\version3.0\5416.exe
%PROGRAM_FILES%\microsoft frontpage\version3.0\bin\2195.exe
%PROGRAM_FILES%\Messenger\7743.exe
%PROGRAM_FILES%\Internet Explorer\MUI\0409\9392.exe
%PROGRAM_FILES%\Internet Explorer\PLUGINS\7515.exe
%PROGRAM_FILES%\Internet Explorer\SIGNUP\2394.exe
%PROGRAM_FILES%\Microsoft.NET\0657.exe
%PROGRAM_FILES%\Movie Maker\Shared\3174.exe
%PROGRAM_FILES%\Movie Maker\Shared\Profiles\2536.exe
%PROGRAM_FILES%\MSBuild\2087.exe
%PROGRAM_FILES%\Movie Maker\MUI\0409\6774.exe
%PROGRAM_FILES%\Microsoft.NET\RedistList\5584.exe
%PROGRAM_FILES%\Movie Maker\5426.exe
%PROGRAM_FILES%\Movie Maker\MUI\9004.exe
%PROGRAM_FILES%\Internet Explorer\MUI\9371.exe
%PROGRAM_FILES%\FireFox\modules\tabview\0042.exe
%PROGRAM_FILES%\FireFox\plugins\2445.exe
%PROGRAM_FILES%\FireFox\res\6215.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\ext\8947.exe
%PROGRAM_FILES%\FireFox\modules\services-crypto\1468.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\6208.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\engines\6432.exe
%PROGRAM_FILES%\FireFox\res\dtd\1885.exe
%PROGRAM_FILES%\FireFox\uninstall\7334.exe
%PROGRAM_FILES%\Internet Explorer\8016.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\8156.exe
%PROGRAM_FILES%\FireFox\searchplugins\9792.exe
%PROGRAM_FILES%\FireFox\res\entityTables\8315.exe
%PROGRAM_FILES%\FireFox\res\fonts\2816.exe
%PROGRAM_FILES%\FireFox\res\html\3251.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic\0801.exe
%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\6435.exe
%WINDIR%\assembly\GAC_MSIL\AspNetMMCExt\8801.exe
%WINDIR%\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\7239.exe
%WINDIR%\assembly\GAC_MSIL\Accessibility\4215.exe
%WINDIR%\assembly\GAC_32\System.Web\2760.exe
%WINDIR%\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\1183.exe
%WINDIR%\assembly\GAC_MSIL\8278.exe
%WINDIR%\assembly\GAC_MSIL\cscompmgd\0307.exe
%WINDIR%\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\3590.exe
%WINDIR%\assembly\GAC_MSIL\IIEHost\3076.exe
%WINDIR%\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\6645.exe
%WINDIR%\assembly\GAC_MSIL\IEHost\0712.exe
%WINDIR%\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\9564.exe
%WINDIR%\assembly\GAC_MSIL\IEExecRemote\5872.exe
%WINDIR%\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\4703.exe
%WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\5812.exe
%WINDIR%\assembly\GAC_32\PresentationCore\7207.exe
%WINDIR%\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\0467.exe
%WINDIR%\assembly\GAC_32\System.Data\8823.exe
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\3411.exe
%WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\5491.exe
%WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\7070.exe
%WINDIR%\assembly\GAC_32\mscorlib\9562.exe
%WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\2178.exe
%WINDIR%\assembly\GAC_32\System.Printing\1606.exe
%WINDIR%\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\8353.exe
%WINDIR%\assembly\GAC_32\System.Transactions\3874.exe
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\4665.exe
%WINDIR%\assembly\GAC_32\System.Data.OracleClient\4527.exe
%WINDIR%\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\4826.exe
%WINDIR%\assembly\GAC_32\System.EnterpriseServices\9113.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\4399.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\6967.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\3744.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\1815.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\8098.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\9369.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\6160.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\1372.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC\8752.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\9756.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\5275.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\0076.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\0472.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\8320.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\5666.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\5366.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\7397.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\8655.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\6624.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\1897.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\6851.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\5691.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\3690.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\4608.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities\3096.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\9721.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\6029.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\5533.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks\8247.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\4518.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3060.exe
%WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\5955.exe
%WINDIR%\assembly\GAC\System.Data.OracleClient\2566.exe
%WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\4695.exe
%WINDIR%\assembly\GAC\System.Data\6327.exe
%WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\9053.exe
%WINDIR%\assembly\GAC\System.Configuration.Install\3362.exe
%WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\4544.exe
%WINDIR%\assembly\GAC\System.Design\3056.exe
%WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\8597.exe
%WINDIR%\assembly\GAC\System.Drawing.Design\4022.exe
%WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\7066.exe
%WINDIR%\assembly\GAC\System.Drawing\9943.exe
%WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\1381.exe
%WINDIR%\assembly\GAC\System.DirectoryServices\2536.exe
%WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\2727.exe
%WINDIR%\assembly\GAC\System\9599.exe
%WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\6686.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa\7775.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\4270.exe
%WINDIR%\assembly\GAC\Microsoft.VisualC\9750.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\8818.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\2496.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\8381.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\1193.exe
%WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\9405.exe
%WINDIR%\assembly\GAC\Regcode\5171.exe
%WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\0656.exe
%WINDIR%\assembly\GAC\mscorcfg\2864.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\4443.exe
%WINDIR%\assembly\GAC\Microsoft_VsaVb\5695.exe
%WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\8798.exe
%WINDIR%\assembly\GAC\System.Web.Services\2761.exe
%WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\5647.exe
%WINDIR%\assembly\GAC\System.Windows.Forms\1617.exe
%WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\5313.exe
%WINDIR%\assembly\GAC\System.Web.Mobile\6318.exe
%WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\3498.exe
%WINDIR%\assembly\GAC\System.Web.RegularExpressions\8794.exe
%WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\1348.exe
%WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\2073.exe
%WINDIR%\assembly\GAC_32\ISymWrapper\1777.exe
%WINDIR%\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\1620.exe
%WINDIR%\assembly\GAC_32\CustomMarshalers\7704.exe
%WINDIR%\assembly\GAC\System.Xml\0288.exe
%WINDIR%\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\4952.exe
%WINDIR%\assembly\GAC_32\3036.exe
%WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\6099.exe
%WINDIR%\assembly\GAC\System.Messaging\3559.exe
%WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\3807.exe
%WINDIR%\assembly\GAC\System.Runtime.Remoting\0172.exe
%WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\6823.exe
%WINDIR%\assembly\GAC\System.EnterpriseServices\3299.exe
%WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\5904.exe
%WINDIR%\assembly\GAC\System.Management\1677.exe
%WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\3031.exe
%WINDIR%\assembly\GAC\System.ServiceProcess\9229.exe
%WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\7739.exe
%WINDIR%\assembly\GAC\System.Web\3152.exe
%WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\7785.exe
%WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\0819.exe
%WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\8819.exe
%WINDIR%\assembly\GAC\System.Security\3474.exe

Deletes the following files:

%WINDIR%\Temp\tmp1.tmp

Moves the following files:

from <SYSTEM32>\wbem\mof\6279.exe to <SYSTEM32>\wbem\mof\bad\6279.exe

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial