Win32.HLLW.Autoruner1.26559

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\Tasks.exe
%HOMEPATH%\Start Menu\Programs\Startup\Startup.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\Startup.exe

Infects the following executable system files:

<SYSTEM32>\XPSViewer\XPSViewer.exe
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe

Substitutes the following executable system files:

<SYSTEM32>\dllcache\pinball.exe with <SYSTEM32>\dllcache\pinball.exe.new

Creates the following files on removable media:

<Drive name for removable media>:\Autorun.inf
<Drive name for removable media>:\MyLetter.exe

Modifies file system :

Creates the following files:

%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\System.Activities.Core.Presentation.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\System.Activities.DurableInstancing.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System\System.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities\System.Activities.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\System.AddIn.Contract.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\System.ComponentModel.Composition.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\System.Activities.Presentation.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\System.AddIn.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\PresentationFramework.Luna.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\PresentationFramework.Royale.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\PresentationFramework.Aero.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\PresentationFramework.Classic.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\SMDiagnostics.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\sysglobl\sysglobl.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\PresentationUI.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\ReachFramework.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design\System.Data.Services.Design.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\System.Data.Services.Client.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services\System.Data.Services.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\System.Data.SqlXml.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Device\System.Device.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Device\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Design\System.Design.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\System.Deployment.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\System.Data.Linq.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\System.Configuration.Install.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\System.Configuration.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\System.ComponentModel.DataAnnotations.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Core\System.Core.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.Design\System.Data.Entity.Design.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\System.Data.Entity.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\System.Data.DataSetExtensions.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Transactions\System.Transactions.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Web\System.Web.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\System.EnterpriseServices.exe
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Printing\System.Printing.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\Microsoft.Build.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\AspNetMMCExt.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\GAC_MSIL.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Accessibility\Accessibility.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\Microsoft.Transactions.Bridge.Dtc.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\Microsoft.VisualBasic.Activities.Compiler.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\CustomMarshalers\CustomMarshalers.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\ISymWrapper\ISymWrapper.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\v4.0_10.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\System.Data.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\System.Data.OracleClient.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\mscorlib.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\PresentationCore\PresentationCore.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\Microsoft.VisualBasic.Compatibility.Data.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\v4.0_10.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\Microsoft.VisualC.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\v4.0_10.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\Microsoft.VisualBasic.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\v4.0_10.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\Microsoft.VisualBasic.Compatibility.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\v4.0_10.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\PresentationBuildTasks.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\PresentationFramework.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\Microsoft.VisualC.STLCLR.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\v4.0_2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\Microsoft.Workflow.Compiler.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\Microsoft.Build.Framework.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\Microsoft.Build.Tasks.v4.0.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\Microsoft.Build.Conversion.v4.0.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\Microsoft.Build.Engine.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\Microsoft.JScript.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\v4.0_10.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\Microsoft.Transactions.Bridge.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\Microsoft.Build.Utilities.v4.0.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\Microsoft.CSharp.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Mobile\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\System.Web.RegularExpressions.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Mobile\System.Web.Mobile.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design\System.Web.Extensions.Design.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing\System.Web.Routing.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\System.Windows.Forms.DataVisualization.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\System.Windows.Forms.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\System.Web.Services.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\System.Web.Extensions.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization.Design\System.Web.DataVisualization.Design.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\System.Web.DataVisualization.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Abstractions\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\System.Web.ApplicationServices.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\System.Web.DynamicData.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.Design\System.Web.Entity.Design.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity\System.Web.Entity.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design\System.Web.DynamicData.Design.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\System.Xml.Linq.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\UIAutomationClient.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\System.Xaml.Hosting.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml\System.Xml.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\UIAutomationTypes.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\WindowsBase\WindowsBase.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\UIAutomationClientsideProviders.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\UIAutomationProvider.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation\System.Windows.Presentation.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\System.Workflow.Activities.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\System.Windows.Forms.DataVisualization.Design.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations\System.Windows.Input.Manipulations.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.WorkflowServices\System.WorkflowServices.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.WorkflowServices\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\System.Xaml.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\System.Workflow.ComponentModel.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime\System.Workflow.Runtime.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Abstractions\System.Web.Abstractions.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\System.Management.Instrumentation.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\System.Messaging.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\System.IO.Log.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Management\System.Management.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\System.Runtime.Caching.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\System.Runtime.DurableInstancing.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Net\System.Net.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Net\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\System.Numerics.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\System.DirectoryServices.Protocols.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\System.Drawing.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\System.DirectoryServices.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\System.DirectoryServices.AccountManagement.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\System.IdentityModel.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\System.IdentityModel.Selectors.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\System.Drawing.Design.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\System.Dynamic.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.ServiceMoniker40\System.ServiceModel.ServiceMoniker40.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.ServiceMoniker40\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\System.ServiceModel.Routing.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery\System.ServiceModel.Discovery.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.WasHosting\System.ServiceModel.WasHosting.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Speech\System.Speech.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Speech\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\System.ServiceProcess.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.WasHosting\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\System.ServiceModel.Web.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\System.ServiceModel.Channels.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\System.Runtime.Serialization.Formatters.Soap.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\System.Runtime.Serialization.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\System.Runtime.Remoting.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Security\System.Security.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\System.ServiceModel.Activities.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\System.ServiceModel.Activation.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\v4.0_4.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\System.ServiceModel.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\v4.0_4.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\015d6049e237304a27105c3846c79648\015d6049e237304a27105c3846c79648.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\System.Web.Entity.D#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\119750ae4265d719a24ebe245e212db7\119750ae4265d719a24ebe245e212db7.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\System.Web.Entity.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\System.Web.DynamicD#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\5bd3f76680b4c09039d42ae873ddd190\5bd3f76680b4c09039d42ae873ddd190.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\c171b28823047a7e9db5f3e092333336\c171b28823047a7e9db5f3e092333336.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\System.Web.Extensio#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\System.Web.RegularE#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\70764208219715962d310336b5959dfa\70764208219715962d310336b5959dfa.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\System.Web.Routing.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\e5995a34d44ad5af7d9f335075bded4d\e5995a34d44ad5af7d9f335075bded4d.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\79f9b2acf94065fd92c54c29ff66017b\79f9b2acf94065fd92c54c29ff66017b.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\d8a3d7926a927b9fd62aeabb16a74ab0\d8a3d7926a927b9fd62aeabb16a74ab0.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\System.Web.Mobile.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\fbe60d84b9f1ab74e396fb1507f69615\fbe60d84b9f1ab74e396fb1507f69615.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\System.ServiceModel#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\bfa7858f498cd67ef58b689c2e0fec89\bfa7858f498cd67ef58b689c2e0fec89.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\System.ServiceProce#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\19644a754454916a619b68315e50b428\19644a754454916a619b68315e50b428.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Security\System.Security.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Security\0418eb6dbffe9b46aa4c989153d6a3b5\0418eb6dbffe9b46aa4c989153d6a3b5.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\System.ServiceModel.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\a9e71dda6389403be4db7b567592e3b8\a9e71dda6389403be4db7b567592e3b8.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web\System.Web.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web\50ea744ffc3cb7f09b027fd6c5c93b2b\50ea744ffc3cb7f09b027fd6c5c93b2b.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\System.Web.Abstract#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\12903c3843fe923d1977801ffa3cf26c\12903c3843fe923d1977801ffa3cf26c.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Speech\System.Speech.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Speech\2e7a6c977ac9f8d46ebe2982697a0c8d\2e7a6c977ac9f8d46ebe2982697a0c8d.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\System.Transactions.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1AC.tmp\ZAP1AC.tmp.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1B.tmp\ZAP1B.tmp.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Temp\ZAP39.tmp\ZAP39.tmp.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Temp\Temp.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\36f3953f24d4f0b767bf172331ad6f3e.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\System.Xml.Linq.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\8c0d96269480bdd3de8a825f0215308d\8c0d96269480bdd3de8a825f0215308d.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\UIAutomationClient.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\8f5c0e1b77c840d99a68897898317b79\8f5c0e1b77c840d99a68897898317b79.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\UIAutomationTypes.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\dbb2fcd246efaf3df823410597cd1677\dbb2fcd246efaf3df823410597cd1677.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\UIAutomationProvider.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\d255ab525d10d8fefe5df9ba092b2df8\d255ab525d10d8fefe5df9ba092b2df8.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\UIAutomationClients#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\8698f073a59ef0db10a3258b1f1deaee\8698f073a59ef0db10a3258b1f1deaee.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\System.Xml.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\9a254c455892c02355ab0ab0f0727c5b.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\System.Windows.Pres#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\b5a285233229bb4f9d9831ebf27fe9ac\b5a285233229bb4f9d9831ebf27fe9ac.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\System.Windows.Forms.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\18e1acd6761195389db42bab83169fd2\18e1acd6761195389db42bab83169fd2.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Services\System.Web.Services.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Services\1dad08772eb89d48a8a0cfe9b0467eb0\1dad08772eb89d48a8a0cfe9b0467eb0.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\System.Workflow.Act#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\6d0966370023925610756f368140b947\6d0966370023925610756f368140b947.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\System.WorkflowServ#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\43911ac4e29949c57560eee5cb7b76c2\43911ac4e29949c57560eee5cb7b76c2.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\System.Workflow.Run#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\d6cc33db5d526553ffbbfd1d372a8493\d6cc33db5d526553ffbbfd1d372a8493.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\System.Workflow.Com#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\9de33f5786cd15e220f47b916c5a15e9\9de33f5786cd15e220f47b916c5a15e9.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\bb748f8ef8c98eb5c7f79b8faee95397\bb748f8ef8c98eb5c7f79b8faee95397.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\57f7cf02ea17b36bc3d9c75c22d0f551\57f7cf02ea17b36bc3d9c75c22d0f551.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\System.Data.Service#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\8582bf6991112c859e843af4321a2fda\8582bf6991112c859e843af4321a2fda.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\System.Data.OracleC#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\9867484f25281882e61f61066fa651a3\9867484f25281882e61f61066fa651a3.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\System.Data.Linq.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\fa206c73f39721cd2c55829b9853de44\fa206c73f39721cd2c55829b9853de44.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\fee2e476d10aac7784f46140ee1b4a59\fee2e476d10aac7784f46140ee1b4a59.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Deployment\System.Deployment.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Deployment\df1efcbac5973454c608890f72eb994d\df1efcbac5973454c608890f72eb994d.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Design\System.Design.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\0ec1b690c5ee057fa92ecff78de1457c\0ec1b690c5ee057fa92ecff78de1457c.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Services\System.Data.Services.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Services\f24134b397836c33a65d4d05c54ef4f5\f24134b397836c33a65d4d05c54ef4f5.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\System.Data.SqlXml.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\System.Data.Entity.#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\22a1629a4dcdd493bbd8be40cc122e94\22a1629a4dcdd493bbd8be40cc122e94.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\System.Configuration.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb4cb21d14767292e079366a5d3d76cd\cb4cb21d14767292e079366a5d3d76cd.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\System.Configuratio#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\f2b48eab657b4ef1d19dac11bdf0c913\f2b48eab657b4ef1d19dac11bdf0c913.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\System.ComponentMod#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\a8e047504bdad9ec14efd483574b0dd5\a8e047504bdad9ec14efd483574b0dd5.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\System.Core.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\4f4ddae492a4a4ce4a2961f3d72d9399\4f4ddae492a4a4ce4a2961f3d72d9399.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\System.Data.Entity.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\8c050147d7031f912f6ca2b15550173f\8c050147d7031f912f6ca2b15550173f.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\System.Data.DataSet#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\6c69930d05c557da70144bcc0add7065\6c69930d05c557da70144bcc0add7065.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\System.Data.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\0b40341027c01716cec1dd97592698e0\0b40341027c01716cec1dd97592698e0.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.I#\1db9deebde7c96b2874b4ffccac2f48e\1db9deebde7c96b2874b4ffccac2f48e.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Messaging\System.Messaging.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Messaging\643e95098a9ce99a598d3419b5ce157f\643e95098a9ce99a598d3419b5ce157f.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.I#\System.Management.I#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IO.Log\bcfccfa22245d2223a764611c61a7cb9\bcfccfa22245d2223a764611c61a7cb9.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\System.Management.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\894d87c08a9a5b5923e7104055a616d2\894d87c08a9a5b5923e7104055a616d2.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Net\System.Net.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\3736ba3ecac186f9c5d85f01bda2be98\3736ba3ecac186f9c5d85f01bda2be98.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\System.Runtime.Seri#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\01dc643b54310ebc5ab7e4696df426bc\01dc643b54310ebc5ab7e4696df426bc.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\System.Runtime.Remo#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Net\eabe1915c13467e1e66e2b073bcb842f\eabe1915c13467e1e66e2b073bcb842f.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Printing\System.Printing.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Printing\db428f231a2ccaf490ae219efd2edc69\db428f231a2ccaf490ae219efd2edc69.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IO.Log\System.IO.Log.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c205bbbb88bfa4bd5e274f43ea0013cb\c205bbbb88bfa4bd5e274f43ea0013cb.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\System.Drawing.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\6978f2e90f13bc720d57fa6895c911e2.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\6bcc481030a56c24d5990d199812c594\6bcc481030a56c24d5990d199812c594.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Design\204db7071fb26343b0fd3f3d140c0bf8\204db7071fb26343b0fd3f3d140c0bf8.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\System.DirectorySer#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\44de75caba2b9711b3d9030a30767f8b\44de75caba2b9711b3d9030a30767f8b.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\System.Drawing.Desi#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\be8c7482f1e78a3b4984af9082d455a7\be8c7482f1e78a3b4984af9082d455a7.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\System.IdentityModel.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\94b2ca600c860c76e387f8bd317bd4c3\94b2ca600c860c76e387f8bd317bd4c3.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\System.IdentityMode#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\5f5d64dd0e7991aaaad2d98ee52afe42\5f5d64dd0e7991aaaad2d98ee52afe42.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\System.EnterpriseSe#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\5f9cd5bfebcb94175d440ebab3aa412f\5f9cd5bfebcb94175d440ebab3aa412f.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\WMarks.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\Scr.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Video\Video.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\Btn.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\Cnt.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Css\Css.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Img.exe
%WINDIR%\ime\ime.exe
%WINDIR%\ime\imejp\imejp.exe
%WINDIR%\ime\imejp\applets\applets.exe
%WINDIR%\ime\imejp98\imejp98.exe
%WINDIR%\ime\CHTIME\Applets\Applets.exe
%WINDIR%\ime\chsime\chsime.exe
%WINDIR%\ime\chsime\applets\applets.exe
%WINDIR%\ime\CHTIME\CHTIME.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\Wav.exe
%WINDIR%\Downloaded Program Files\Downloaded Program Files.exe
%WINDIR%\Driver Cache\Driver Cache.exe
%WINDIR%\Driver Cache\i386\i386.exe
%WINDIR%\Debug\UserMode\UserMode.exe
%WINDIR%\Connection Wizard\Connection Wizard.exe
%WINDIR%\Cursors\Cursors.exe
%WINDIR%\Debug\Debug.exe
%WINDIR%\ehome\ehome.exe
%WINDIR%\Help\Tours\mmTour\mmTour.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\WindowsMediaPlayer.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Audio.exe
%WINDIR%\Help\Tours\htmlTour\htmlTour.exe
%WINDIR%\Fonts\Fonts.exe
%WINDIR%\Help\Help.exe
%WINDIR%\Help\Tours\Tours.exe
%WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\1.1.4322\1.1.4322.exe
%WINDIR%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}.exe
%WINDIR%\Installer\{BAF78226-3200-4DB4-BE33-4D922A799840}\{BAF78226-3200-4DB4-BE33-4D922A799840}.exe
%WINDIR%\Installer\$PatchCache$\Managed\DDE7F2BCF1D91C3409CFF425AE1E271A\DDE7F2BCF1D91C3409CFF425AE1E271A.exe
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\3.0.6920.exe
%WINDIR%\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\DC3BF90CC0D3D2F398A9A6D1762F70F3.exe
%WINDIR%\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729.exe
%WINDIR%\Installer\{FE9126DB-5F84-495A-BB46-3C724F1C2D08}\{FE9126DB-5F84-495A-BB46-3C724F1C2D08}.exe
%WINDIR%\Microsoft.NET\Microsoft.NET.exe
%WINDIR%\Microsoft.NET\assembly\assembly.exe
%WINDIR%\Microsoft.NET\assembly\GAC_32\GAC_32.exe
%WINDIR%\Media\Media.exe
%WINDIR%\java\java.exe
%WINDIR%\java\classes\classes.exe
%WINDIR%\java\trustlib\trustlib.exe
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\62287FAB00234BD4EB33D429A2978904.exe
%WINDIR%\ime\imkr6_1\dicts\dicts.exe
%WINDIR%\ime\shared\shared.exe
%WINDIR%\ime\shared\res\res.exe
%WINDIR%\ime\imkr6_1\applets\applets.exe
%WINDIR%\ime\imjp8_1\imjp8_1.exe
%WINDIR%\ime\imjp8_1\applets\applets.exe
%WINDIR%\ime\imkr6_1\imkr6_1.exe
%WINDIR%\inf\inf.exe
%WINDIR%\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729.exe
%WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\26DDC2EC4210AC63483DF9D4FCC5B59D.exe
%WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\3.5.30729.exe
%WINDIR%\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\0DC1503A46F231838AD88BCDDC8E8F7C.exe
%WINDIR%\Installer\Installer.exe
%WINDIR%\Installer\$PatchCache$\$PatchCache$.exe
%WINDIR%\Installer\$PatchCache$\Managed\Managed.exe
%WINDIR%\Config\Config.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\3963e9ce8d44f50e8367e92a8e3e42e6\3963e9ce8d44f50e8367e92a8e3e42e6.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\PresentationFramewo#.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\016f9a150fce0e0a4c93532d8fa4c749\016f9a150fce0e0a4c93532d8fa4c749.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\PresentationCore.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\05503f37aef5261d80ccca19f8078679\05503f37aef5261d80ccca19f8078679.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\mscorlib.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\246f1a5abb686b9dcdf22d3505b08cea\246f1a5abb686b9dcdf22d3505b08cea.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\040571d65dc822e5df020d5e084f4b45\040571d65dc822e5df020d5e084f4b45.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\964da027ebca3b263a05cadb8eaa20a3\964da027ebca3b263a05cadb8eaa20a3.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\System.ComponentMod#.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\4a518b841f06ee4f07320159cf918a2c\4a518b841f06ee4f07320159cf918a2c.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\System.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\3555f5f74c56fa92c0ab7a635af91bfa\3555f5f74c56fa92c0ab7a635af91bfa.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\7f91eecda3ff7ce478146b6458580c98\7f91eecda3ff7ce478146b6458580c98.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\f5e029e2215c95ab38a1eefef7b32ac9\f5e029e2215c95ab38a1eefef7b32ac9.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\Microsoft.CSharp.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\WsatConfig.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\7d2a3adbdcb675f872eb2dbf21f73596.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\NativeImages_v4.0.30319_32.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\a18dff8832712a0f6cccaaefbcc45861\a18dff8832712a0f6cccaaefbcc45861.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WindowsBase\WindowsBase.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WindowsBase\df20e56b59b1b1a595af305ddc0777ba\df20e56b59b1b1a595af305ddc0777ba.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\WindowsFormsIntegra#.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Accessibility\Accessibility.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\51819c709096229ee187a7feee395d9f.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\dfsvc.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\b9b6069e6da06eb57e89cc544397f735.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\ComSvcConfig.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Accessibility\01254caa0efc15b5cd48fb3178018701\01254caa0efc15b5cd48fb3178018701.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\AspNetMMCExt\AspNetMMCExt.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\AspNetMMCExt\03bf63d8ea6622a32b9a3fc6851801a9\03bf63d8ea6622a32b9a3fc6851801a9.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\System.Security.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\09a97525ae5583cc2685e2c39a3078bd\09a97525ae5583cc2685e2c39a3078bd.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\System.Windows.Forms.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\b07f0d26a34ad53fc369248f289d1126\b07f0d26a34ad53fc369248f289d1126.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dynamic\System.Dynamic.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dynamic\1331ee3a7146218388537aa7e41303af\1331ee3a7146218388537aa7e41303af.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\System.Numerics.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\17e020ae92d7fab33bcc1c98b25019d0\17e020ae92d7fab33bcc1c98b25019d0.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\d17606e813f01376bd0def23726ecc62\d17606e813f01376bd0def23726ecc62.exe
%WINDIR%\assembly\temp\temp.exe
%WINDIR%\assembly\tmp\tmp.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\WindowsBase.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\System.Xml.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\e997d0200c25f7db6bd32313d50b729d\e997d0200c25f7db6bd32313d50b729d.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\Temp\Temp.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing.Desi#\8f9993d3eb4cd33d1452155f79b23d65\8f9993d3eb4cd33d1452155f79b23d65.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\System.Data.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\92cccedc7cda413ff6fc6492cb256b58\92cccedc7cda413ff6fc6492cb256b58.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\System.Data.Linq.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\713647b987b140a17e3c4ffe4c721f85\713647b987b140a17e3c4ffe4c721f85.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\System.Configuration.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\ac18c2dcd06bd2a0589bac94ccae5716\ac18c2dcd06bd2a0589bac94ccae5716.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\System.Core.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\87a713cee613d08ee04ae9483a9d4716\87a713cee613d08ee04ae9483a9d4716.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\System.Drawing.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\dd57bc19f5807c6dbe8f88d4a23277f6\dd57bc19f5807c6dbe8f88d4a23277f6.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing.Desi#\System.Drawing.Desi#.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Design\95a46d4775428acf5dd84f12aaa9f06f\95a46d4775428acf5dd84f12aaa9f06f.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\System.Data.SqlXml.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\1fdd0961d8d07ef4d1fcaf30f0050c0a\1fdd0961d8d07ef4d1fcaf30f0050c0a.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Design\System.Design.exe
<SYSTEM32>\en-us\en-us.exe
<SYSTEM32>\export\export.exe
<SYSTEM32>\ias\ias.exe
<DRIVERS>\etc\etc.exe
<SYSTEM32>\dllcache\dllcache.exe
<DRIVERS>\drivers.exe
<DRIVERS>\disdn\disdn.exe
<SYSTEM32>\icsxml\icsxml.exe
<SYSTEM32>\inetsrv\inetsrv.exe
<SYSTEM32>\Macromed\Macromed.exe
<SYSTEM32>\Macromed\Flash\Flash.exe
<SYSTEM32>\IME\TINTLGNT\TINTLGNT.exe
<SYSTEM32>\IME\IME.exe
<SYSTEM32>\IME\CINTLGNT\CINTLGNT.exe
<SYSTEM32>\IME\PINTLGNT\PINTLGNT.exe
<SYSTEM32>\DirectX\Dinput\Dinput.exe
<SYSTEM32>\config\systemprofile\Recent\Recent.exe
<SYSTEM32>\config\systemprofile\SendTo\SendTo.exe
<SYSTEM32>\config\systemprofile\Start Menu\Start Menu.exe
<SYSTEM32>\config\systemprofile\PrintHood\PrintHood.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\W32JX7IL\W32JX7IL.exe
<SYSTEM32>\config\systemprofile\My Documents\My Documents.exe
<SYSTEM32>\config\systemprofile\NetHood\NetHood.exe
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Programs.exe
<SYSTEM32>\config\systemprofile\Templates\Templates.exe
<SYSTEM32>\dhcp\dhcp.exe
<SYSTEM32>\DirectX\DirectX.exe
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Startup\Startup.exe
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessories.exe
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Entertainment\Entertainment.exe
<SYSTEM32>\mui\040e\040e.exe
<SYSTEM32>\mui\0410\0410.exe
<SYSTEM32>\mui\0411\0411.exe
<SYSTEM32>\mui\040D\040D.exe
<SYSTEM32>\mui\0409\0409.exe
<SYSTEM32>\mui\040b\040b.exe
<SYSTEM32>\mui\040C\040C.exe
<SYSTEM32>\mui\0412\0412.exe
<SYSTEM32>\mui\0418\0418.exe
<SYSTEM32>\mui\0419\0419.exe
<SYSTEM32>\mui\041a\041a.exe
<SYSTEM32>\mui\0416\0416.exe
<SYSTEM32>\mui\0413\0413.exe
<SYSTEM32>\mui\0414\0414.exe
<SYSTEM32>\mui\0415\0415.exe
<SYSTEM32>\mui\0408\0408.exe
<SYSTEM32>\MsDtc\MsDtc.exe
<SYSTEM32>\MsDtc\Trace\Trace.exe
<SYSTEM32>\mui\mui.exe
<SYSTEM32>\Microsoft\Protect\S-1-5-18\User\User.exe
<SYSTEM32>\Microsoft\Microsoft.exe
<SYSTEM32>\Microsoft\Protect\Protect.exe
<SYSTEM32>\Microsoft\Protect\S-1-5-18\S-1-5-18.exe
<SYSTEM32>\mui\0009\0009.exe
<SYSTEM32>\mui\0405\0405.exe
<SYSTEM32>\mui\0406\0406.exe
<SYSTEM32>\mui\0407\0407.exe
<SYSTEM32>\mui\0404\0404.exe
<SYSTEM32>\mui\0401\0401.exe
<SYSTEM32>\mui\0402\0402.exe
<SYSTEM32>\mui\0403\0403.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\RK37EMDC\RK37EMDC.exe
<SYSTEM32>\1037\1037.exe
<SYSTEM32>\1041\1041.exe
<SYSTEM32>\1042\1042.exe
<SYSTEM32>\1033\1033.exe
<SYSTEM32>\1025\1025.exe
<SYSTEM32>\1028\1028.exe
<SYSTEM32>\1031\1031.exe
<SYSTEM32>\1054\1054.exe
<SYSTEM32>\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}.exe
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}.exe
<SYSTEM32>\CatRoot2\CatRoot2.exe
<SYSTEM32>\CatRoot\CatRoot.exe
<SYSTEM32>\2052\2052.exe
<SYSTEM32>\3076\3076.exe
<SYSTEM32>\3com_dmi\3com_dmi.exe
<SYSTEM32>\system32.exe
%WINDIR%\SoftwareDistribution\SoftwareDistribution.exe
%WINDIR%\SoftwareDistribution\DataStore\DataStore.exe
%WINDIR%\SoftwareDistribution\DataStore\Logs\Logs.exe
%WINDIR%\security\templates\templates.exe
%WINDIR%\security\security.exe
%WINDIR%\security\Database\Database.exe
%WINDIR%\security\logs\logs.exe
%WINDIR%\SoftwareDistribution\Download\Download.exe
%WINDIR%\srchasst\mui\mui.exe
%WINDIR%\srchasst\mui\0409\0409.exe
%WINDIR%\system\system.exe
%WINDIR%\srchasst\chars\chars.exe
%WINDIR%\SoftwareDistribution\EventCache\EventCache.exe
%WINDIR%\SoftwareDistribution\SelfUpdate\SelfUpdate.exe
%WINDIR%\srchasst\srchasst.exe
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\Media Player\Media Player.exe
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\Windows Media.exe
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\9.0\9.0.exe
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\Microsoft.exe
<SYSTEM32>\config\systemprofile\Favorites\Favorites.exe
<SYSTEM32>\config\systemprofile\Local Settings\Local Settings.exe
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Application Data.exe
<SYSTEM32>\config\systemprofile\Local Settings\History\History.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6YQRA29M\6YQRA29M.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\E4T10P5J\E4T10P5J.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
<SYSTEM32>\config\systemprofile\Local Settings\History\History.IE5\History.IE5.exe
<SYSTEM32>\config\systemprofile\Local Settings\History\History.IE5\MSHist012011111020111111\MSHist012011111020111111.exe
<SYSTEM32>\config\systemprofile\Local Settings\Temp\Temp.exe
<SYSTEM32>\config\systemprofile\Desktop\Desktop.exe
<SYSTEM32>\config\systemprofile\systemprofile.exe
<SYSTEM32>\config\systemprofile\Application Data\Application Data.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Microsoft.exe
<SYSTEM32>\config\config.exe
<SYSTEM32>\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}.exe
<SYSTEM32>\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}.exe
<SYSTEM32>\Com\Com.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\Internet Explorer.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
<SYSTEM32>\config\systemprofile\Cookies\Cookies.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Media Player\Media Player.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\SystemCertificates.exe
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\My.exe
%WINDIR%\WinSxS\Policies\Policies.exe
%WINDIR%\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac.exe
%WINDIR%\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5.exe
%WINDIR%\WinSxS\InstallTemp\InstallTemp.exe
%WINDIR%\WinSxS\Manifests\Manifests.exe
%WINDIR%\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e.exe
%WINDIR%\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd.exe
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773.exe
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150.exe
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e.exe
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff.exe
%WINDIR%\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f.exe
%WINDIR%\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775.exe
%WINDIR%\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3.exe
%WINDIR%\WinSxS\WinSxS.exe
<SYSTEM32>\wbem\snmp\snmp.exe
<SYSTEM32>\wbem\xml\xml.exe
<SYSTEM32>\wins\wins.exe
<SYSTEM32>\wbem\Repository\FS\FS.exe
%WINDIR%\Temp\tmp1.tmp
<SYSTEM32>\wbem\Performance\Performance.exe
<SYSTEM32>\wbem\Repository\Repository.exe
<SYSTEM32>\xircom\xircom.exe
%WINDIR%\Web\printers\printers.exe
%WINDIR%\Web\printers\images\images.exe
%WINDIR%\Web\Wallpaper\Wallpaper.exe
%WINDIR%\Web\Web.exe
<SYSTEM32>\XPSViewer\en-US\en-US.exe
%WINDIR%\Temp\Temp.exe
%WINDIR%\twain_32\twain_32.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0.exe
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790.exe
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377.exe
%WINDIR%\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace.exe
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.exe
<SYSTEM32>\wbem\mof\good\good.exe
<SYSTEM32>\oobe\html\html.exe
<SYSTEM32>\oobe\html\dslmain\dslmain.exe
<SYSTEM32>\oobe\html\iconnect\iconnect.exe
<SYSTEM32>\oobe\error\error.exe
<SYSTEM32>\npp\npp.exe
<SYSTEM32>\oobe\oobe.exe
<SYSTEM32>\oobe\actsetup\actsetup.exe
<SYSTEM32>\oobe\html\ispsgnup\ispsgnup.exe
<SYSTEM32>\oobe\html\oemhw\oemhw.exe
<SYSTEM32>\oobe\html\oemreg\oemreg.exe
<SYSTEM32>\oobe\html\sconnect\sconnect.exe
<SYSTEM32>\oobe\html\oemcust\oemcust.exe
<SYSTEM32>\oobe\html\isptype\isptype.exe
<SYSTEM32>\oobe\html\mouse\mouse.exe
<SYSTEM32>\oobe\html\mouse\images\images.exe
<SYSTEM32>\mui\dispspec\dispspec.exe
<SYSTEM32>\mui\0422\0422.exe
<SYSTEM32>\mui\0424\0424.exe
<SYSTEM32>\mui\0425\0425.exe
<SYSTEM32>\mui\041f\041f.exe
<SYSTEM32>\mui\041b\041b.exe
<SYSTEM32>\mui\041D\041D.exe
<SYSTEM32>\mui\041e\041e.exe
<SYSTEM32>\mui\0426\0426.exe
<SYSTEM32>\mui\0816\0816.exe
<SYSTEM32>\mui\081a\081a.exe
<SYSTEM32>\mui\0C0A\0C0A.exe
<SYSTEM32>\mui\0804\0804.exe
<SYSTEM32>\mui\0427\0427.exe
<SYSTEM32>\mui\042a\042a.exe
<SYSTEM32>\mui\042d\042d.exe
<SYSTEM32>\spool\XPSEP\amd64\amd64.exe
<SYSTEM32>\spool\XPSEP\amd64\amd64\amd64.exe
<SYSTEM32>\spool\XPSEP\i386\i386.exe
<SYSTEM32>\spool\XPSEP\XPSEP.exe
<SYSTEM32>\spool\prtprocs\prtprocs.exe
<SYSTEM32>\spool\prtprocs\w32x86\w32x86.exe
<SYSTEM32>\spool\prtprocs\x64\x64.exe
<SYSTEM32>\spool\XPSEP\i386\i386\i386.exe
<SYSTEM32>\wbem\Logs\Logs.exe
<SYSTEM32>\wbem\mof\mof.exe
<SYSTEM32>\wbem\mof\bad\bad.exe
<SYSTEM32>\wbem\AutoRecover\AutoRecover.exe
<SYSTEM32>\URTTEMP\URTTEMP.exe
<SYSTEM32>\usmt\usmt.exe
<SYSTEM32>\wbem\wbem.exe
<SYSTEM32>\spool\PRINTERS\PRINTERS.exe
<SYSTEM32>\oobe\sample\sample.exe
<SYSTEM32>\oobe\setup\setup.exe
<SYSTEM32>\ras\ras.exe
<SYSTEM32>\oobe\regerror\regerror.exe
<SYSTEM32>\oobe\icserror\icserror.exe
<SYSTEM32>\oobe\images\images.exe
<SYSTEM32>\oobe\isperror\isperror.exe
<SYSTEM32>\Restore\Restore.exe
<SYSTEM32>\spool\drivers\color\color.exe
<SYSTEM32>\spool\drivers\w32x86\w32x86.exe
<SYSTEM32>\spool\drivers\w32x86\3\3.exe
<SYSTEM32>\spool\drivers\drivers.exe
<SYSTEM32>\Setup\Setup.exe
<SYSTEM32>\ShellExt\ShellExt.exe
<SYSTEM32>\spool\spool.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\Permissions.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Security.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\Images.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\Providers.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\Roles.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\Config.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\Browsers\Browsers.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\Wizard.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\Users.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\chrome\chrome.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults\defaults.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults\preferences\preferences.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\DotNetAssistantExtension.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\SQL\SQL.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\SQL\EN\EN.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\Windows Presentation Foundation.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\v4.0.30319.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\App_Code.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Data\App_Data.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_GlobalResources\App_GlobalResources.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\1033\1033.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\ASP.NETWebAdminFiles.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\AppConfig.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\1043.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\1044.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\1045.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\1042.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\1038.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\1040.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\1041.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\1046.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\2070.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\3076.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\3082.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\2052.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\1049.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\1053.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\1055.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\1037.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\SetupCache.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Client.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\1025.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\0409\0409.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MOF\MOF.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\MUI.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\1028.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\1033.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\1035.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\1036.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\1032.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\1029.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\1030.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\1031.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\App_Code.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data\App_Data.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\App_GlobalResources.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\1033\1033.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\ASP.NETWebAdminFiles.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\AppConfig.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\Permissions.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Security.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\Images.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\Providers.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\v2.0.50727.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\Framework\Framework.exe
%WINDIR%\Microsoft.NET\Framework\v1.0.3705\v1.0.3705.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask\XamlBuildTask.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\WindowsFormsIntegration.exe
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\v4.0_4.0.0.0__31bf3856ad364e35.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\v1.1.4322.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MUI\0409\0409.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Temporary ASP.NET Files.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MUI\MUI.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\1033.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\ASP.NETClientFiles.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\CONFIG.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\Windows Workflow Foundation.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\SQL.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\EN\EN.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\MUI\0409\0409.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\Logs.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Windows Communication Foundation.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\MUI\MUI.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\WPF.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Microsoft .NET Framework 3.5 SP1.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\Logs.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\MOF\MOF.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\1033\1033.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\en-US\en-US.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\v3.5.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Microsoft .NET Framework 3.0 x86.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\Wizard.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\CONFIG.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\Roles.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\App_LocalResources.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\Users.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\Browsers.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\SubsetList\SubsetList.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\v3.0.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RedistList\RedistList.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MUI\MUI.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MUI\0409\0409.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Remote Assistance.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\Common.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Css\Css.exe
%WINDIR%\pchealth\helpctr\System\rc\rc.exe
%WINDIR%\pchealth\helpctr\System\NetDiag\NetDiag.exe
%WINDIR%\pchealth\helpctr\System\panels\panels.exe
%WINDIR%\pchealth\helpctr\System\panels\subpanels\subpanels.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Interaction.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\sysinfo.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\graphics.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\33x16pie.exe
%WINDIR%\pchealth\helpctr\System\scripts\scripts.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\Client.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Common.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\Server.exe
%WINDIR%\pchealth\helpctr\System\images\Expando\Expando.exe
%WINDIR%\pchealth\helpctr\System\DFS\DFS.exe
%WINDIR%\pchealth\helpctr\System\dialogs\dialogs.exe
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\DVDUpgrd.exe
%WINDIR%\pchealth\helpctr\System\css\css.exe
%WINDIR%\pchealth\helpctr\System\System.exe
%WINDIR%\pchealth\helpctr\System\blurbs\blurbs.exe
%WINDIR%\pchealth\helpctr\System\CompatCtr\CompatCtr.exe
%WINDIR%\pchealth\helpctr\System\ErrMsg\ErrMsg.exe
%WINDIR%\pchealth\helpctr\System\images\32x32\32x32.exe
%WINDIR%\pchealth\helpctr\System\images\48x48\48x48.exe
%WINDIR%\pchealth\helpctr\System\images\Centers\Centers.exe
%WINDIR%\pchealth\helpctr\System\images\24x24\24x24.exe
%WINDIR%\pchealth\helpctr\System\errors\errors.exe
%WINDIR%\pchealth\helpctr\System\images\images.exe
%WINDIR%\pchealth\helpctr\System\images\16x16\16x16.exe
%WINDIR%\pss\pss.exe
%WINDIR%\Registration\Registration.exe
%WINDIR%\Registration\CRMLog\CRMLog.exe
%WINDIR%\Provisioning\Schemas\Schemas.exe
%WINDIR%\PeerNet\PeerNet.exe
%WINDIR%\Prefetch\Prefetch.exe
%WINDIR%\Provisioning\Provisioning.exe
%WINDIR%\repair\repair.exe
%WINDIR%\Resources\Themes\Luna\Shell\Homestead\Homestead.exe
%WINDIR%\Resources\Themes\Luna\Shell\Metallic\Metallic.exe
%WINDIR%\Resources\Themes\Luna\Shell\NormalColor\NormalColor.exe
%WINDIR%\Resources\Themes\Luna\Shell\Shell.exe
%WINDIR%\Resources\Resources.exe
%WINDIR%\Resources\Themes\Themes.exe
%WINDIR%\Resources\Themes\Luna\Luna.exe
%WINDIR%\pchealth\UploadLB\Config\Config.exe
%WINDIR%\pchealth\helpctr\Vendors\Vendors.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Remote Assistance.exe
%WINDIR%\pchealth\helpctr\Temp\Temp.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\47x24pie.exe
%WINDIR%\pchealth\helpctr\System\UpdateCtr\UpdateCtr.exe
%WINDIR%\pchealth\helpctr\System_OEM\System_OEM.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\Common.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\Unsolicited.exe
%WINDIR%\pchealth\UploadLB\UploadLB.exe
%WINDIR%\pchealth\UploadLB\Binaries\Binaries.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\Email.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\Css.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Escalation.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Common.exe
%WINDIR%\pchealth\helpctr\PackageStore\PackageStore.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\1046.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\1049.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\1053.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\1045.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\1042.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\1043.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\1044.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\1055.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Extended\Extended.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Graphics\Graphics.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SQL\SQL.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\3082.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\2052.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\2070.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\3076.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\1041.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\1028.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\1029.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\1030.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\1025.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Client\Client.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Graphics\Graphics.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Extended.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\1031.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\1037.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\1038.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\1040.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\1036.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\1032.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\1033.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\1035.exe
%WINDIR%\pchealth\helpctr\Config\Config.exe
%WINDIR%\pchealth\helpctr\Config\Cache\Cache.exe
%WINDIR%\pchealth\helpctr\Config\CheckPoint\CheckPoint.exe
%WINDIR%\pchealth\helpctr\binaries\binaries.exe
%WINDIR%\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF.exe
%WINDIR%\pchealth\helpctr\helpctr.exe
%WINDIR%\pchealth\helpctr\BATCH\BATCH.exe
%WINDIR%\pchealth\helpctr\Database\Database.exe
%WINDIR%\pchealth\helpctr\Logs\Logs.exe
%WINDIR%\pchealth\helpctr\OfflineCache\OfflineCache.exe
%WINDIR%\pchealth\helpctr\OfflineCache\Professional_32#0409\Professional_32#0409.exe
%WINDIR%\pchealth\helpctr\InstalledSKUs\InstalledSKUs.exe
%WINDIR%\pchealth\helpctr\DataColl\DataColl.exe
%WINDIR%\pchealth\helpctr\HelpFiles\HelpFiles.exe
%WINDIR%\pchealth\helpctr\Indices\Indices.exe
%WINDIR%\pchealth\ERRORREP\QHEADLES\QHEADLES.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\Fonts.exe
%WINDIR%\msagent\msagent.exe
%WINDIR%\msagent\chars\chars.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\en-US\en-US.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SQL\en\en.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\Temporary ASP.NET Files.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPF.exe
%WINDIR%\msagent\intl\intl.exe
%WINDIR%\Offline Web Pages\Offline Web Pages.exe
%WINDIR%\pchealth\pchealth.exe
%WINDIR%\pchealth\ERRORREP\ERRORREP.exe
%WINDIR%\ocx\ocx.exe
%WINDIR%\msapps\msapps.exe
%WINDIR%\msapps\msinfo\msinfo.exe
%WINDIR%\mui\mui.exe
%CommonProgramFiles%\Microsoft Shared\Web Folders\Web Folders.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\web server extensions.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\40.exe
%CommonProgramFiles%\Microsoft Shared\VGX\VGX.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\TextConv.exe
%CommonProgramFiles%\Microsoft Shared\Triedit\Triedit.exe
%CommonProgramFiles%\Microsoft Shared\VC\VC.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\admcgi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\1033.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\bots.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\vinavbar.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\bin.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\scripts.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\admisapi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\scripts.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Stationery.exe
%CommonProgramFiles%\Microsoft Shared\DW\1031\1031.exe
%CommonProgramFiles%\Microsoft Shared\DW\1033\1033.exe
%CommonProgramFiles%\Microsoft Shared\DW\1036\1036.exe
%CommonProgramFiles%\Microsoft Shared\DW\1028\1028.exe
%CommonProgramFiles%\Microsoft Shared\DAO\DAO.exe
%CommonProgramFiles%\Microsoft Shared\DW\DW.exe
%CommonProgramFiles%\Microsoft Shared\DW\1025\1025.exe
%CommonProgramFiles%\Microsoft Shared\DW\1040\1040.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\MSInfo.exe
%CommonProgramFiles%\Microsoft Shared\Speech\Speech.exe
%CommonProgramFiles%\Microsoft Shared\Speech\1033\1033.exe
%CommonProgramFiles%\Microsoft Shared\DW\3082\3082.exe
%CommonProgramFiles%\Microsoft Shared\DW\1041\1041.exe
%CommonProgramFiles%\Microsoft Shared\DW\1042\1042.exe
%CommonProgramFiles%\Microsoft Shared\DW\2052\2052.exe
%CommonProgramFiles%\System\System.exe
%CommonProgramFiles%\System\ado\ado.exe
%CommonProgramFiles%\System\msadc\msadc.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\1033.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\Lexicon.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\1033.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\TTS.exe
%CommonProgramFiles%\System\Ole DB\Ole DB.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\branding\branding.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\bookmarks.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\content.exe
%PROGRAM_FILES%\ComPlus Applications\ComPlus Applications.exe
%PROGRAM_FILES%\FireFox\chrome\chrome.exe
%PROGRAM_FILES%\FireFox\chrome\browser\browser.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Microsoft.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_bin.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\_vti_adm.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\_vti_aut.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\servsupp.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\isapi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\_vti_adm.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\_vti_aut.exe
%CommonProgramFiles%\MSSoap\MSSoap.exe
%CommonProgramFiles%\ODBC\Data Sources\Data Sources.exe
%CommonProgramFiles%\Services\Services.exe
%CommonProgramFiles%\SpeechEngines\SpeechEngines.exe
%CommonProgramFiles%\ODBC\ODBC.exe
%CommonProgramFiles%\MSSoap\Binaries\Binaries.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\Resources.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\1033.exe
%CommonProgramFiles%\Microsoft Shared\Microsoft Shared.exe
C:\Far2\Plugins\ExtSearch\keys\keys.exe
C:\Far2\Plugins\ExtSearch\sources\sources.exe
C:\Far2\Plugins\ExtSearch\sources\RegExp\RegExp.exe
C:\Far2\Plugins\ExtSearch\doc\doc.exe
C:\Far2\Plugins\EditCase\EditCase.exe
C:\Far2\Plugins\EMenu\EMenu.exe
C:\Far2\Plugins\ExtSearch\ExtSearch.exe
C:\Far2\Plugins\FarCmds\FarCmds.exe
C:\Far2\Plugins\MacroView\MacroView.exe
C:\Far2\Plugins\Network\Network.exe
C:\Far2\Plugins\ProcList\ProcList.exe
C:\Far2\Plugins\HlfViewer\HlfViewer.exe
C:\Far2\Plugins\FileCase\FileCase.exe
C:\Far2\Plugins\FTP\FTP.exe
C:\Far2\Plugins\FTP\lib\lib.exe
C:\Far2\Plugins\DrawLine\DrawLine.exe
C:\Far2\Plugins\AutoWrap\AutoWrap.exe
C:\Far2\Plugins\Brackets\Brackets.exe
C:\Far2\Plugins\Colorer\Colorer.exe
C:\Far2\Plugins\arclite\arclite.exe
C:\Far2\Plugins\Plugins.exe
C:\Far2\Plugins\7-Zip\7-Zip.exe
C:\Far2\Plugins\Align\Align.exe
C:\Far2\Plugins\Colorer\bin\bin.exe
C:\Far2\Plugins\Colorer\hrd\console\console.exe
C:\Far2\Plugins\Colorer\hrd\console\contrib\contrib.exe
C:\Far2\Plugins\Compare\Compare.exe
C:\Far2\Plugins\Colorer\hrd\hrd.exe
C:\Far2\Plugins\Colorer\hrc\hrc.exe
C:\Far2\Plugins\Colorer\hrc\auto\auto.exe
C:\Far2\Plugins\Colorer\hrc\auto\types\types.exe
C:\Far2\Plugins\WinSCP\putty\charset\charset.exe
C:\Far2\Plugins\WinSCP\putty\windows\windows.exe
C:\Far2\Plugins\WinSCP\release\release.exe
C:\Far2\Plugins\WinSCP\putty\putty.exe
C:\Far2\Plugins\WinSCP\packages\tb2k\tb2k.exe
C:\Far2\Plugins\WinSCP\packages\tbx\tbx.exe
C:\Far2\Plugins\WinSCP\packages\theme\theme.exe
C:\Far2\Plugins\WinSCP\resource\resource.exe
<Auxiliary element>
%PROGRAM_FILES%\Program Files.exe
%CommonProgramFiles%\Common Files.exe
C:\Far2\PluginSDK\Headers.pas\Headers.pas.exe
C:\Far2\Plugins\WinSCP\windows\windows.exe
C:\Far2\PluginSDK\PluginSDK.exe
C:\Far2\PluginSDK\Headers.c\Headers.c.exe
C:\Far2\Plugins\WinSCP\packages\my\my.exe
C:\Far2\Plugins\WinSCP\core\core.exe
C:\Far2\Plugins\WinSCP\dragext\dragext.exe
C:\Far2\Plugins\WinSCP\far\far.exe
C:\Far2\Plugins\WinSCP\console\console.exe
C:\Far2\Plugins\TmpPanel\TmpPanel.exe
C:\Far2\Plugins\WinSCP\WinSCP.exe
C:\Far2\Plugins\WinSCP\components\components.exe
C:\Far2\Plugins\WinSCP\fari\fari.exe
C:\Far2\Plugins\WinSCP\packages\packages.exe
C:\Far2\Plugins\WinSCP\packages\dragndrop\dragndrop.exe
C:\Far2\Plugins\WinSCP\packages\filemng\filemng.exe
C:\Far2\Plugins\WinSCP\lib\lib.exe
C:\Far2\Plugins\WinSCP\filezilla\filezilla.exe
C:\Far2\Plugins\WinSCP\filezilla\misc\misc.exe
C:\Far2\Plugins\WinSCP\forms\forms.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\xml.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\bindings.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\cpow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\svg.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\passwordmgr\passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\satchel\satchel.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\update\update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\profile\profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\alerts\alerts.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pippki\pippki.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\services\services.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pipnss\pipnss.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\necko\necko.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\passwordmgr\passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\feedback\feedback.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\content.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\cookie\cookie.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\toolkit.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\pippki.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\content.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\pippki\pippki.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\handling\handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\splitter.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\toolbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\tree.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\viewsource\viewsource.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\scrollbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\aero.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\alerts\alerts.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\classic.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\xbl-marquee\xbl-marquee.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\res.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\skin.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\media.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\printpreview.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\icons.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\checkbox.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\dirListing.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\update\update.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\tabbrowser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\tabbrowser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\tabview.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\tabview.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\branding.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\communicator.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\en-US.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\locale.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\pageinfo.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\migration.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\certerror.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\history.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\safebrowsing.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\aero.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\search.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\skin.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\classic.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\mac.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\unix.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\win\win.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\global-platform.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\xml.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\xslt.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-region\global-region.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\profile.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\handling.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\extensions.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\svg.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\sidebar.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\browser-region.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\en-US.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\safebrowsing.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\migration.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\alerts.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\layout.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\search.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\security.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\dom.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\autoconfig.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\cookie.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\global.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\Entertainment.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Startup.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessories.exe
C:\Documents and Settings\Default User\SendTo\SendTo.exe
C:\Documents and Settings\Default User\Start Menu\Start Menu.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Programs.exe
C:\Documents and Settings\Default User\Templates\Templates.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\S-1-5-19.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Internet Explorer.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\Media Player.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\Credentials.exe
C:\Documents and Settings\LocalService\LocalService.exe
C:\Documents and Settings\LocalService\Application Data\Application Data.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\Default User\Recent\Recent.exe
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\History.IE5.exe
C:\Documents and Settings\Default User\Local Settings\Temp\Temp.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
C:\Documents and Settings\Default User\Local Settings\History\History.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\Media Player.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\Windows Media.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\9.0.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
C:\Documents and Settings\Default User\My Documents\My Documents.exe
C:\Documents and Settings\Default User\NetHood\NetHood.exe
C:\Documents and Settings\Default User\PrintHood\PrintHood.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\YPORKZYZ.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2VAZY7AN.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\KHMHGZ4F.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\U98D4X8H.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\MOE00UY1.exe
C:\Documents and Settings\NetworkService\NetworkService.exe
C:\Documents and Settings\NetworkService\Application Data\Application Data.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\LBMMC3H3.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\BGGTYMH1.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\CJCTQ25G.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\SystemCertificates.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\My.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\Media Player.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\Credentials.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\S-1-5-20.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\Internet Explorer.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
C:\Documents and Settings\LocalService\Cookies\Cookies.exe
C:\Documents and Settings\LocalService\Local Settings\Local Settings.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\SystemCertificates.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\My.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Application Data.exe
C:\Documents and Settings\LocalService\Local Settings\History\History.exe
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\History.IE5.exe
C:\Documents and Settings\LocalService\Local Settings\Temp\Temp.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\Windows.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\Credentials.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\S-1-5-19.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Microsoft.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Connections.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\Cm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\Pbk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Network.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\HTML Help.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\Media Index.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\Media Player.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\User Account Pictures.exe
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\My Playlists.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Sample Music.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\Sample Playlists.exe
%ALLUSERSPROFILE%\Documents\My Music\My Music.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\Default Pictures.exe
%ALLUSERSPROFILE%\Desktop\Desktop.exe
%ALLUSERSPROFILE%\Documents\Documents.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\Dr Watson.exe
<Current directory>\af32d3b0.exe
C:\Documents and Settings\Documents and Settings.exe
%ALLUSERSPROFILE%\All Users.exe
C:\Autorun.inf
C:\My Diary_ .exe
C:\MyLetter.exe
%ALLUSERSPROFILE%\Application Data\Application Data.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\RSA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\MachineKeys.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\S-1-5-18.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\MachineKeys.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Microsoft.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\Crypto.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\DSS.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\Media Player.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\SystemCertificates.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\My.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Internet Explorer.exe
C:\Documents and Settings\Default User\Default User.exe
C:\Documents and Settings\Default User\Application Data\Application Data.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
C:\Documents and Settings\Default User\Favorites\Favorites.exe
C:\Documents and Settings\Default User\Local Settings\Local Settings.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Application Data.exe
C:\Documents and Settings\Default User\Desktop\Desktop.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
C:\Documents and Settings\Default User\Cookies\Cookies.exe
%ALLUSERSPROFILE%\Templates\Templates.exe
%ALLUSERSPROFILE%\DRM\DRM.exe
%ALLUSERSPROFILE%\Favorites\Favorites.exe
%ALLUSERSPROFILE%\Start Menu\Start Menu.exe
%ALLUSERSPROFILE%\Documents\My Videos\My Videos.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\0338E140.exe
%ALLUSERSPROFILE%\Documents\My Pictures\My Pictures.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sample Pictures.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Programs.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\System Tools.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Administrative Tools.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Games.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\Entertainment.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessories.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Communications.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\startupCache.exe
<LS_APPDATA>\VMware\VMware.exe
%HOMEPATH%\Local Settings\History\History.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\F.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\C.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\D.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\E.exe
%HOMEPATH%\Local Settings\History\History.IE5\History.IE5.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2VAZY7AN.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\KHMHGZ4F.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\U98D4X8H.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\MSHist012011111020111111.exe
%TEMP%\Temp.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\B.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\0.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\1.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\2.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\Cache.exe
<LS_APPDATA>\Mozilla\Firefox\Firefox.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\Profiles.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\cwdgt0y8.default.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\3.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\8.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\9.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\A.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\7.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\4.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\5.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\6.exe
C:\Far2\Addons\Colors\Default Highlighting\Default Highlighting.exe
C:\Far2\Addons\Macros\Macros.exe
C:\Far2\Addons\SetUp\SetUp.exe
C:\Far2\Addons\Colors\Custom Highlighting\Custom Highlighting.exe
C:\Far2\Far2.exe
C:\Far2\Addons\Addons.exe
C:\Far2\Addons\Colors\Colors.exe
C:\Far2\Addons\Shell\Shell.exe
C:\Far2\Documentation\rus\rus.exe
C:\Far2\Encyclopedia\Encyclopedia.exe
C:\Far2\FExcept\FExcept.exe
C:\Far2\Documentation\eng\eng.exe
C:\Far2\Addons\XLat\XLat.exe
C:\Far2\Addons\XLat\Russian\Russian.exe
C:\Far2\Documentation\Documentation.exe
%HOMEPATH%\Templates\Templates.exe
%HOMEPATH%\My Documents\My Pictures\My Pictures.exe
%HOMEPATH%\My Documents\My Received Files\My Received Files.exe
%HOMEPATH%\NetHood\NetHood.exe
%HOMEPATH%\My Documents\My Music\My Music.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\YPORKZYZ.exe
%HOMEPATH%\My Documents\My Documents.exe
%HOMEPATH%\My Documents\Downloads\Downloads.exe
%HOMEPATH%\PrintHood\PrintHood.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Accessories.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\Entertainment.exe
%HOMEPATH%\Start Menu\Programs\Programs.exe
%HOMEPATH%\Recent\Recent.exe
%HOMEPATH%\SendTo\SendTo.exe
%HOMEPATH%\Start Menu\Start Menu.exe
<LS_APPDATA>\Mozilla\Mozilla.exe
%APPDATA%\Identities\Identities.exe
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}.exe
%APPDATA%\Microsoft\Microsoft.exe
%APPDATA%\Application Data.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\U98D4X8H.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\YPORKZYZ.exe
%HOMEPATH%\%USERNAME%.exe
%APPDATA%\Microsoft\Address Book\Address Book.exe
%APPDATA%\Microsoft\Media Player\Media Player.exe
%APPDATA%\Microsoft\MMC\MMC.exe
%APPDATA%\Microsoft\SystemCertificates\SystemCertificates.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Quick Launch.exe
%APPDATA%\Microsoft\Credentials\Credentials.exe
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\S-1-5-21-2052111302-484763869-725345543-1003.exe
%APPDATA%\Microsoft\Internet Explorer\Internet Explorer.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\KHMHGZ4F.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Application Data.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\Credentials.exe
C:\Documents and Settings\NetworkService\Local Settings\Local Settings.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
C:\Documents and Settings\NetworkService\Cookies\Cookies.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\S-1-5-20.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2VAZY7AN.exe
C:\Documents and Settings\NetworkService\Local Settings\Temp\Temp.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\Windows.exe
C:\Documents and Settings\NetworkService\Local Settings\History\History.exe
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\History.IE5.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Microsoft.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\Outlook Express.exe
<LS_APPDATA>\Identities\Identities.exe
%HOMEPATH%\Favorites\Links\Links.exe
%HOMEPATH%\Local Settings\Local Settings.exe
<LS_APPDATA>\Application Data.exe
<LS_APPDATA>\Microsoft\Microsoft.exe
<LS_APPDATA>\Microsoft\Windows\Windows.exe
<LS_APPDATA>\Microsoft\Windows Media\Windows Media.exe
<LS_APPDATA>\Microsoft\Windows Media\9.0\9.0.exe
<LS_APPDATA>\Microsoft\Media Player\Media Player.exe
<LS_APPDATA>\Microsoft\CD Burning\CD Burning.exe
<LS_APPDATA>\Microsoft\Credentials\Credentials.exe
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\S-1-5-21-2052111302-484763869-725345543-1003.exe
%HOMEPATH%\Favorites\Favorites.exe
%APPDATA%\Microsoft\Windows\Windows.exe
%APPDATA%\Microsoft\Windows\Themes\Themes.exe
%APPDATA%\Mozilla\Mozilla.exe
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
%APPDATA%\Microsoft\SystemCertificates\My\My.exe
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
%APPDATA%\Mozilla\Extensions\Extensions.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\chrome.exe
%HOMEPATH%\Cookies\Cookies.exe
%HOMEPATH%\Desktop\Desktop.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarkbackups.exe
%APPDATA%\Mozilla\Firefox\Firefox.exe
%APPDATA%\Mozilla\Firefox\Profiles\Profiles.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cwdgt0y8.default.exe
%WINDIR%\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\3.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Management\System.Management.exe
%WINDIR%\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.IO.Log\System.IO.Log.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel.Selectors\System.IdentityModel.Selectors.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Management.Instrumentation\System.Management.Instrumentation.exe
%WINDIR%\assembly\GAC_MSIL\System.Net\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Remoting\System.Runtime.Remoting.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Net\System.Net.exe
%WINDIR%\assembly\GAC_MSIL\System.Management.Instrumentation\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Messaging\System.Messaging.exe
%WINDIR%\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel\System.IdentityModel.exe
%WINDIR%\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices\System.DirectoryServices.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Design\System.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Deployment\System.Deployment.exe
%WINDIR%\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\System.DirectoryServices.AccountManagement.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing.Design\System.Drawing.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing\System.Drawing.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.Protocols\System.DirectoryServices.Protocols.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData\System.Web.DynamicData.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData.Design\System.Web.DynamicData.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Abstractions\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Speech\System.Speech.exe
%WINDIR%\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Abstractions\System.Web.Abstractions.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions\System.Web.Extensions.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions.Design\System.Web.Extensions.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity.Design\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity\System.Web.Entity.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity.Design\System.Web.Entity.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Security\System.Security.exe
%WINDIR%\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel\System.ServiceModel.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization\System.Runtime.Serialization.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\System.Runtime.Serialization.Formatters.Soap.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Web\System.ServiceModel.Web.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceProcess\System.ServiceProcess.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Install\System.ServiceModel.Install.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.WasHosting\System.ServiceModel.WasHosting.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.SqlXml\System.Data.SqlXml.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Luna\PresentationFramework.Luna.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Royale\PresentationFramework.Royale.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Aero\PresentationFramework.Aero.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Classic\PresentationFramework.Classic.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\Sentinel.v3.5Client\Sentinel.v3.5Client.exe
%WINDIR%\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\SMDiagnostics\SMDiagnostics.exe
%WINDIR%\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationUI\PresentationUI.exe
%WINDIR%\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\ReachFramework\ReachFramework.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\Microsoft.Vsa.Vb.CodeDOMProcessor.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft_VsaVb\Microsoft_VsaVb.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\Microsoft.VisualC.STLCLR.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\1.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa\Microsoft.Vsa.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\PresentationFontCache.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework\PresentationFramework.exe
%WINDIR%\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationBuildTasks\PresentationBuildTasks.exe
%WINDIR%\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationCFFRasterizer\PresentationCFFRasterizer.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity.Design\System.Data.Entity.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity\System.Data.Entity.exe
%WINDIR%\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.DataSetExtensions\System.Data.DataSetExtensions.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Linq\System.Data.Linq.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Client\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Design\System.Data.Services.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Design\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Client\System.Data.Services.Client.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services\System.Data.Services.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Core\System.Core.exe
%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn\System.AddIn.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System\System.exe
%WINDIR%\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\sysglobl\sysglobl.exe
%WINDIR%\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn.Contract\System.AddIn.Contract.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration.Install\System.Configuration.Install.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration\System.Configuration.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\System.ComponentModel.DataAnnotations.exe
%WINDIR%\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\539e297cc9bc67fbf2fbdc9dc5fcd0f1\539e297cc9bc67fbf2fbdc9dc5fcd0f1.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\Microsoft.VisualBas#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5b3d048d8c003d743ea5e72caf07773a\5b3d048d8c003d743ea5e72caf07773a.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\21bb6244c91b6207fbcb038884a641ef\21bb6244c91b6207fbcb038884a641ef.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\Microsoft.JScript.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\7d61e63dea85f4f77ea4c13df7651ec7\7d61e63dea85f4f77ea4c13df7651ec7.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\Microsoft.Transacti#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\Microsoft.VisualC.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\87c84ffaaad81d8d106a9aa9d68b5926.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\mscorlib.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\9adb89fa22fd5b4ce433b5aca7fb1b07.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\MSBuild.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\f0e9a97ade4529d4caeccd467aa8e7db\f0e9a97ade4529d4caeccd467aa8e7db.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\Microsoft.Vsa.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\28ea74096df47800fe2c78bb2b9a4f2a\28ea74096df47800fe2c78bb2b9a4f2a.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\43dceeb2d0601d79af40752fb20283c2\43dceeb2d0601d79af40752fb20283c2.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\Microsoft.Build.Eng#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\ce984d7bbd9a6d5d3cca28c4e5038020\ce984d7bbd9a6d5d3cca28c4e5038020.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\daf5ff5e06c80eefa80c6fcc79aec963\daf5ff5e06c80eefa80c6fcc79aec963.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\c5c4db4f9bc7a454e9cfc2548a9d45a5\c5c4db4f9bc7a454e9cfc2548a9d45a5.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\dfsvc.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\a2865dcec9c5d3cc9c55f026cbad6fcc.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\Microsoft.Build.Con#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\Microsoft.Build.Fra#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\cd6eeb3d7ea1f65c28a43e665db38644\cd6eeb3d7ea1f65c28a43e665db38644.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\Microsoft.Build.Uti#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\28eede53267524df58362a75a668cf86\28eede53267524df58362a75a668cf86.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\152cf75db013f0523933ac45177b4217\152cf75db013f0523933ac45177b4217.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\36dbc4689f7c51e393504230004c9dec\36dbc4689f7c51e393504230004c9dec.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\66359457e427c0d547750a79f754f9ba\66359457e427c0d547750a79f754f9ba.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\Microsoft.Build.Tas#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\SMDiagnostics.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\2e19ccefc30d7b827bab3f7d8dcc0ab9\2e19ccefc30d7b827bab3f7d8dcc0ab9.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\SMSvcHost.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\6781b87c8d3b55e6120b1e86bea6e040.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ReachFramework\ReachFramework.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ReachFramework\5c59991df60164cae10fd81b88a8e5b1\5c59991df60164cae10fd81b88a8e5b1.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\ServiceModelReg.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\b9c1a29e684bc02e49226ff1e9eec253.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn\System.AddIn.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn\b01721205312c6c18df033cc47b60e5c\b01721205312c6c18df033cc47b60e5c.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\System.AddIn.Contra#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\aa7926460a336408c8041330ad90929d.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\sysglobl\sysglobl.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\sysglobl\6e07cc846884a853b910775fcec87ced\6e07cc846884a853b910775fcec87ced.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\System.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationUI\87fb973e4ab6a21fd00e45656fa7c115\87fb973e4ab6a21fd00e45656fa7c115.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCore\PresentationCore.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCore\12dcb10b76012416357bdbb010fdaa97\12dcb10b76012416357bdbb010fdaa97.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\PresentationFontCac#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\487c1bc20f6e73e8e79503898d17d102\487c1bc20f6e73e8e79503898d17d102.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\PresentationBuildTa#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\b6bfb51dec7f8cc42c21c5928470c773\b6bfb51dec7f8cc42c21c5928470c773.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\PresentationCFFRast#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\9469981a17c01dd154c540127e678b35.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\b4dc4bd8534d90fbb7430926ad990cd9\b4dc4bd8534d90fbb7430926ad990cd9.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ef1a93d10c3a91b728745dbfcc79c2c7\ef1a93d10c3a91b728745dbfcc79c2c7.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationUI\PresentationUI.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\9e71fd0d299c5668c96a54e4a63479fa\9e71fd0d299c5668c96a54e4a63479fa.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\PresentationFramewo#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\79c2fd29b1e46c943960278051b4e1b9\79c2fd29b1e46c943960278051b4e1b9.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\9519494798a88867406b5755e1dbded6\9519494798a88867406b5755e1dbded6.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\e148983beeb0f30918b0564849a16456\e148983beeb0f30918b0564849a16456.exe
%WINDIR%\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml\System.Xml.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.WorkflowServices\System.WorkflowServices.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Runtime\System.Workflow.Runtime.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml.Linq\System.Xml.Linq.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationProvider\UIAutomationProvider.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClientsideProviders\UIAutomationClientsideProviders.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClient\UIAutomationClient.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.ComponentModel\System.Workflow.ComponentModel.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Routing\System.Web.Routing.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.RegularExpressions\System.Web.RegularExpressions.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Mobile\System.Web.Mobile.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Services\System.Web.Services.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Presentation\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Activities\System.Workflow.Activities.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Presentation\System.Windows.Presentation.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\System.Windows.Forms.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_353815cd\1.0.5000.0__b77a5c561934e089_353815cd.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Xml\System.Xml.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_f236c56a\1.0.5000.0__b77a5c561934e089_f236c56a.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\System.Windows.Forms.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_c34133cb\1.0.5000.0__b03f5f7f11d50a3a_c34133cb.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\System.Drawing.Design.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_7cac80ba\1.0.5000.0__b03f5f7f11d50a3a_7cac80ba.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\NativeImages_v2.0.50727_32.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\ComSvcConfig.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\19b50dd470540911fc5cc65331a769e4.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\CustomMarshalers.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\c7ffd8c23e8de4018a88185b3b60631e\c7ffd8c23e8de4018a88185b3b60631e.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Accessibility\Accessibility.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Accessibility\c2af7cfbb47c077029a2645930b4eeac\c2af7cfbb47c077029a2645930b4eeac.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\AspNetMMCExt.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing\System.Drawing.exe
%WINDIR%\assembly\GAC_MSIL\WindowsFormsIntegration\WindowsFormsIntegration.exe
%WINDIR%\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\NativeImages1_v1.1.4322.exe
%WINDIR%\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationTypes\UIAutomationTypes.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\WindowsBase\WindowsBase.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\CustomMarshalers\CustomMarshalers.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_27b9fd4f\1.0.5000.0__b77a5c561934e089_27b9fd4f.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Design\System.Design.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_cd264933\1.0.5000.0__b03f5f7f11d50a3a_cd264933.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System\System.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_b50667e9\1.0.5000.0__b03f5f7f11d50a3a_b50667e9.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\mscorlib\mscorlib.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_5917eb5b\1.0.5000.0__b77a5c561934e089_5917eb5b.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\RedistList.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\SubsetList.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\v3.5.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\v3.0.exe
%PROGRAM_FILES%\Reference Assemblies\Reference Assemblies.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Microsoft.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\Framework.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\RedistList.exe
%PROGRAM_FILES%\Windows Media Player\Sample Playlists\Sample Playlists.exe
%PROGRAM_FILES%\Windows Media Player\Skins\Skins.exe
%PROGRAM_FILES%\Windows Media Player\Visualizations\Visualizations.exe
%PROGRAM_FILES%\Windows Media Player\Icons\Icons.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\SubsetList.exe
%PROGRAM_FILES%\Uninstall Information\Uninstall Information.exe
%PROGRAM_FILES%\Windows Media Player\Windows Media Player.exe
%PROGRAM_FILES%\Outlook Express\Outlook Express.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\v3.0.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\v3.5.exe
%PROGRAM_FILES%\MSN\MSN.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\Windows Workflow Foundation.exe
%PROGRAM_FILES%\Movie Maker\Shared\Profiles\Profiles.exe
%PROGRAM_FILES%\MSBuild\MSBuild.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Microsoft.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\MSNCoreFiles.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\Windows.exe
%PROGRAM_FILES%\NetMeeting\NetMeeting.exe
%PROGRAM_FILES%\Online Services\Online Services.exe
%PROGRAM_FILES%\MSN Gaming Zone\MSN Gaming Zone.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\Install.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\MSN9Components.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\OOBE\OOBE.exe
%WINDIR%\assembly\GAC\IEExecRemote\IEExecRemote.exe
%WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\IEHost\IEHost.exe
%WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\cscompmgd\cscompmgd.exe
%WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\CustomMarshalers\CustomMarshalers.exe
%WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft.JScript\Microsoft.JScript.exe
%WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic\Microsoft.VisualBasic.exe
%WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\IIEHost\IIEHost.exe
%WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\ISymWrapper\ISymWrapper.exe
%WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%PROGRAM_FILES%\xerox\nwwia\nwwia.exe
C:\RECYCLER\RECYCLER.exe
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\S-1-5-21-2052111302-484763869-725345543-1003.exe
%PROGRAM_FILES%\xerox\xerox.exe
%PROGRAM_FILES%\Windows NT\Windows NT.exe
%PROGRAM_FILES%\Windows NT\Accessories\Accessories.exe
%PROGRAM_FILES%\WindowsUpdate\WindowsUpdate.exe
%WINDIR%\WINDOWS.exe
%WINDIR%\assembly\assembly.exe
%WINDIR%\assembly\GAC\GAC.exe
%WINDIR%\assembly\GAC\Accessibility\Accessibility.exe
%WINDIR%\AppPatch\AppPatch.exe
%WINDIR%\$NtUninstallKB942288-v3$\$NtUninstallKB942288-v3$.exe
%WINDIR%\$NtUninstallWIC$\$NtUninstallWIC$.exe
%WINDIR%\addins\addins.exe
%PROGRAM_FILES%\Movie Maker\Shared\Shared.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\update\update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\viewsource\viewsource.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\handling\handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\defaults\profile\profile.exe
%PROGRAM_FILES%\FireFox\defaults\profile\chrome\chrome.exe
%PROGRAM_FILES%\FireFox\dictionaries\dictionaries.exe
%PROGRAM_FILES%\FireFox\defaults\pref\pref.exe
%PROGRAM_FILES%\FireFox\components\components.exe
%PROGRAM_FILES%\FireFox\defaults\defaults.exe
%PROGRAM_FILES%\FireFox\defaults\autoconfig\autoconfig.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\dirListing\dirListing.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\icons\icons.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\media\media.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\console\console.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\alerts\alerts.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\checkbox\checkbox.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\printpreview\printpreview.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\tree\tree.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\toolbar\toolbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\radio\radio.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\scrollbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\splitter\splitter.exe
%PROGRAM_FILES%\Internet Explorer\PLUGINS\PLUGINS.exe
%PROGRAM_FILES%\Internet Explorer\SIGNUP\SIGNUP.exe
%PROGRAM_FILES%\Messenger\Messenger.exe
%PROGRAM_FILES%\Internet Explorer\MUI\0409\0409.exe
%PROGRAM_FILES%\Internet Explorer\Internet Explorer.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\Connection Wizard.exe
%PROGRAM_FILES%\Internet Explorer\MUI\MUI.exe
%PROGRAM_FILES%\microsoft frontpage\microsoft frontpage.exe
%PROGRAM_FILES%\Movie Maker\Movie Maker.exe
%PROGRAM_FILES%\Movie Maker\MUI\MUI.exe
%PROGRAM_FILES%\Movie Maker\MUI\0409\0409.exe
%PROGRAM_FILES%\Microsoft.NET\RedistList\RedistList.exe
%PROGRAM_FILES%\microsoft frontpage\version3.0\version3.0.exe
%PROGRAM_FILES%\microsoft frontpage\version3.0\bin\bin.exe
%PROGRAM_FILES%\Microsoft.NET\Microsoft.NET.exe
%PROGRAM_FILES%\FireFox\uninstall\uninstall.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\services-sync.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\engines\engines.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\ext\ext.exe
%PROGRAM_FILES%\FireFox\modules\services-crypto\services-crypto.exe
%PROGRAM_FILES%\FireFox\extensions\extensions.exe
%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\{972ce4c6-7e08-4474-a285-3208198ce6fd}.exe
%PROGRAM_FILES%\FireFox\modules\modules.exe
%PROGRAM_FILES%\FireFox\modules\tabview\tabview.exe
%PROGRAM_FILES%\FireFox\res\fonts\fonts.exe
%PROGRAM_FILES%\FireFox\res\html\html.exe
%PROGRAM_FILES%\FireFox\searchplugins\searchplugins.exe
%PROGRAM_FILES%\FireFox\res\entityTables\entityTables.exe
%PROGRAM_FILES%\FireFox\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\res\res.exe
%PROGRAM_FILES%\FireFox\res\dtd\dtd.exe
%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\AspNetMMCExt\AspNetMMCExt.exe
%WINDIR%\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Accessibility\Accessibility.exe
%WINDIR%\assembly\GAC_32\System.Web\System.Web.exe
%WINDIR%\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\GAC_MSIL.exe
%WINDIR%\assembly\GAC_MSIL\cscompmgd\cscompmgd.exe
%WINDIR%\assembly\GAC_MSIL\IEHost\IEHost.exe
%WINDIR%\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\IIEHost\IIEHost.exe
%WINDIR%\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\2.0.0.0__b03f5f7f11d50a3a.exe
<SYSTEM32>\dllcache\pinball.exe.new
%WINDIR%\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\IEExecRemote\IEExecRemote.exe
%WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_32\PresentationCore\PresentationCore.exe
%WINDIR%\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_32\System.Data\System.Data.exe
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\Microsoft.Transactions.Bridge.Dtc.exe
%WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\3.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_32\mscorlib\mscorlib.exe
%WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_32\System.Printing\System.Printing.exe
%WINDIR%\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_32\System.Transactions\System.Transactions.exe
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_32\System.Data.OracleClient\System.Data.OracleClient.exe
%WINDIR%\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_32\System.EnterpriseServices\System.EnterpriseServices.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\3.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\Microsoft.VisualBasic.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\Microsoft.Transactions.Bridge.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\Microsoft.JScript.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\Microsoft.VisualBasic.Compatibility.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC\Microsoft.VisualC.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\Microsoft.VisualBasic.Vsa.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\Microsoft.VisualBasic.Compatibility.Data.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\Microsoft.Build.Utilities.v3.5.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\Microsoft.Build.Framework.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\Microsoft.Build.Engine.exe
%WINDIR%\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\Microsoft.Build.Conversion.v3.5.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities\Microsoft.Build.Utilities.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\Microsoft.Build.Tasks.v3.5.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks\Microsoft.Build.Tasks.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC\System.Data.OracleClient\System.Data.OracleClient.exe
%WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC\System.Data\System.Data.exe
%WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC\System.Configuration.Install\System.Configuration.Install.exe
%WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Design\System.Design.exe
%WINDIR%\assembly\GAC\System.Drawing\System.Drawing.exe
%WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Drawing.Design\System.Drawing.Design.exe
%WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.DirectoryServices\System.DirectoryServices.exe
%PROGRAM_FILES%\Windows NT\Pinball\pinball.exe.new
%WINDIR%\assembly\GAC\System\System.exe
%WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa\Microsoft.Vsa.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft.VisualC\Microsoft.VisualC.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\Microsoft.VisualBasic.Vsa.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\Microsoft.Vsa.Vb.CodeDOMProcessor.exe
%WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Regcode\Regcode.exe
%WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\mscorcfg\mscorcfg.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft_VsaVb\Microsoft_VsaVb.exe
%WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Web.Services\System.Web.Services.exe
%WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Web.RegularExpressions\System.Web.RegularExpressions.exe
%WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Web.Mobile\System.Web.Mobile.exe
%WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Windows.Forms\System.Windows.Forms.exe
%WINDIR%\assembly\GAC_32\CustomMarshalers\CustomMarshalers.exe
%WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_32\ISymWrapper\ISymWrapper.exe
%WINDIR%\assembly\GAC_32\GAC_32.exe
%WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC\System.Xml\System.Xml.exe
%WINDIR%\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC\System.Web\System.Web.exe
%WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Messaging\System.Messaging.exe
%WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Management\System.Management.exe
%WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.EnterpriseServices\System.EnterpriseServices.exe
%WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Runtime.Remoting\System.Runtime.Remoting.exe
%WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.ServiceProcess\System.ServiceProcess.exe
%WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Security\System.Security.exe
%WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\System.Runtime.Serialization.Formatters.Soap.exe
%WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe

Sets the 'hidden' attribute to the following files:

C:\Autorun.inf
<Drive name for removable media>:\Autorun.inf
C:\MyLetter.exe
<Drive name for removable media>:\MyLetter.exe

Deletes the following files:

%WINDIR%\Temp\tmp1.tmp

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information