Process PID CPU Description Company Name System Idle Process 0 Interrupts n/a 1.49 Hardware Interrupts DPCs n/a 1.49 Deferred Procedure Calls System 4 smss.exe 504 Windows NT Session Manager Microsoft Corporation csrss.exe 560 Client Server Runtime Process Microsoft Corporation winlogon.exe 584 Windows NT Logon Application Microsoft Corporation services.exe 628 1.49 Services and Controller app Microsoft Corporation svchost.exe 808 Generic Host Process for Win32 Services Microsoft Corporation svchost.exe 832 92.54 Generic Host Process for Win32 Services Microsoft Corporation svchost.exe 964 Generic Host Process for Win32 Services Microsoft Corporation svchost.exe 1008 Generic Host Process for Win32 Services Microsoft Corporation spoolsv.exe 1100 Spooler SubSystem App Microsoft Corporation FrameworkService.exe 1220 Framework Service Network Associates, Inc. Mcshield.exe 1256 On-Access Scanner service Network Associates, Inc. VsTskMgr.exe 1272 Task Manager : scheduling and OAS alerting service Network Associates, Inc. svchost.exe 1392 Generic Host Process for Win32 Services Microsoft Corporation vsmon.exe 1420 TrueVector Service Zone Labs Inc. minilog.exe 1588 TrueVector Basic Alert Logger Zone Labs Inc. iPodService.exe 1244 iPodService Module Apple Computer, Inc. lsass.exe 640 LSA Shell (Export Version) Microsoft Corporation explorer.exe 1808 Windows Explorer Microsoft Corporation shstat.exe 468 On-access scanner statistics Network Associates, Inc. UpdaterUI.exe 376 Common User Interface Network Associates, Inc. EM_EXEC.EXE 544 Control Center Logitech Inc. opware32.exe 116 OCR Aware (32-bit) ScanSoft, Inc qttask.exe 932 Apple Computer, Inc. CTHELPER.EXE 1388 CtHelper Application Creative Technology Ltd ADGJDet.exe 996 Creative JetDetect ctfmon.exe 676 CTF Loader Microsoft Corporation TeaTimer.exe 1660 System settings protector Safer Networking Limited swdoctor.exe 1844 Spyware Doctor PCTools getright.exe 2196 GetRightŪ www.getright.com Headlight Software, Inc. zapro.exe 2240 ZoneAlarm Pro Zone Labs Inc. sgmain.exe 2272 SpywareGuard sgbhp.exe 2288 SG Browser Hijacking Protection DVDRegionFree.exe 2592 DVD Region-Free Application Fengtao Software procexp.exe 3680 2.99 Sysinternals Process Explorer Sysinternals OUTLOOK.EXE 3816 Microsoft Outlook Microsoft Corporation firefox.exe 232 Firefox Mozilla Process: svchost.exe Pid: 832 Type Name Desktop \Default Desktop \SADesktop Directory \Windows Directory \BaseNamedObjects Directory \KnownDlls Event \BaseNamedObjects\DHCPNEWIPADDRESS Event \BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS Event \BaseNamedObjects\EVENT_READYROOT/CIMV2SCM EVENT PROVIDER Event \BaseNamedObjects\EVENT_READYROOT/CIMV2PROVIDERSUBSYSTEM Event \BaseNamedObjects\EVENT_READYROOT/CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER Event \BaseNamedObjects\EVENT_READYROOT/CIMV2STANDARD NON-COM EVENT PROVIDER Event \BaseNamedObjects\crypt32LogoffEvent Event \BaseNamedObjects\ShellHWDetection'sEvent Event \BaseNamedObjects\CGenericServiceManager__Init Event \BaseNamedObjects\DINPUTWINMM Event \BaseNamedObjects\userenv: User Profile setup event Event \BaseNamedObjects\WIRELESS_POLICY_CHANGE_EVENT Event \BaseNamedObjects\ShellHWDetection'sEvent Event \BaseNamedObjects\PrefetchOverrideIdle Event \BaseNamedObjects\PrefetchProcessingComplete Event \BaseNamedObjects\PrefetchTracesReady Event \BaseNamedObjects\PrefetchParametersChanged Event \BaseNamedObjects\WkssvcToAgentStartEvent Event \BaseNamedObjects\WkssvcToAgentStopEvent Event \BaseNamedObjects\AgentToWkssvcEvent Event \BaseNamedObjects\wkssvc: MUP finished initializing event Event \BaseNamedObjects\ReSyncKernel Event \Device\DmControl\VxKernel2VoldEvent Event \LanmanServerAnnounceEvent Event \BaseNamedObjects\SENS Started Event Event \BaseNamedObjects\SRCounter Event \BaseNamedObjects\SRStopEvent Event \BaseNamedObjects\SRInitEvent Event \BaseNamedObjects\SRIdleReqEvent Event \Security\TRKWKS_EVENT Event \BaseNamedObjects\SC_AutoStartComplete Event \BaseNamedObjects\W32TIME_NAMED_EVENT_SYSTIME_NOT_CORRECT Event \BaseNamedObjects\userenv: Machine Group Policy has been applied Event \BaseNamedObjects\WINMGMT_COREDLL_CANSHUTDOWN Event \BaseNamedObjects\WINMGMT_PROVIDER_CANSHUTDOWN Event \BaseNamedObjects\WINMGMT_COREDLL_UNLOADED Event \BaseNamedObjects\WINMGMT_COREDLL_LOADED Event \BaseNamedObjects\WINMGMT_MARSHALLING_SERVER_TERMINATE Event \BaseNamedObjects\WINMGMT_NEED_REGISTRATION Event \BaseNamedObjects\WINMGMT_REGISTRATION_DONE Event \BaseNamedObjects\WMI_SysEvent_LodCtr Event \BaseNamedObjects\WMI_SysEvent_UnLodCtr Event \BaseNamedObjects\WMI_RevAdap_Set Event \BaseNamedObjects\WMI_RevAdap_ACK Event \BaseNamedObjects\WMI_ProcessIdleTasksStart Event \BaseNamedObjects\WMI_ProcessIdleTasksComplete Event \BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS Event \BaseNamedObjects\WinMMConsoleAudioEvent Event \BaseNamedObjects\TermSrvReadyEvent Event \BaseNamedObjects\TermSrv: machine GP event Event \BaseNamedObjects\ReconEvent Event \BaseNamedObjects\ShellHWDetectionInitCompleted Event \BaseNamedObjects\WINMGMT_PROVIDER_CANSHUTDOWN Event \BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS Event \BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS Event \BaseNamedObjects\--.-mailslot-53cb31a0-UnimodemNotifyTSP File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805 File \Device\00000060\Tsp File \Device\NamedPipe\DhcpClient File \Device\NamedPipe\PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER File \Device\NamedPipe\PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER File \Device\Udp File \Device\Afd\Endpoint File \Device\NamedPipe\ROUTER File \Device\NamedPipe\ROUTER File \Device\NamedPipe\ROUTER File \Device\Ip File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805 File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805 File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805 File \Device\NamedPipe\ntsvcs File \Device\Ndisuio File \Device\WMIDataDevice File \Device\WMIDataDevice File \Device\NamedPipe\svcctl File \Device\NamedPipe\ROUTER File C:\WINDOWS\SchedLgU.Txt File \Device\00000060\Client File \Device\KsecDD File \Device\Afd\Endpoint File \Device\Tcp File \Device\NamedPipe\Winsock2\CatalogChangeListener-340-0 File \Device\NamedPipe\atsvc File \Device\NamedPipe\atsvc File C:\WINDOWS\Tasks File \Device\Afd\Endpoint File \Device\LanmanRedirector File \Device\LanmanDatagramReceiver File \Device\NamedPipe\wkssvc File \Device\NamedPipe\keysvc File \Device\NamedPipe\keysvc File \Device\NamedPipe\net\NtControlPipe3 File \Device\NamedPipe\srvsvc File \Device\NamedPipe\svcctl File \Device\NamedPipe\svcctl File \Device\NamedPipe\PCHHangRepExecPipe File \Device\NamedPipe\PCHFaultRepExecPipe File C:\WINDOWS\PCHEALTH\HELPCTR\BATCH File \Device\LanmanServer File \Device\NamedPipe\srvsvc File \Device\NamedPipe\SECLOGON File \Device\NamedPipe\SECLOGON File \FileSystem\Filters\SystemRestore File \Device\NamedPipe\svcctl File \Device\NamedPipe\lsarpc File \Device\NamedPipe\trkwks File \Device\NamedPipe\trkwks File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805 File C:\WINDOWS\ModemLog_U.S. Robotics 56K Message.txt File \Device\NamedPipe\W32TIME File \Device\NamedPipe\W32TIME File C:\WINDOWS\system32\wbem\mof File \Device\NamedPipe\srvsvc File \Device\Udp File \Device\Afd\Endpoint File \Device\NamedPipe\WMDMPMSPpipe File \Device\LanmanDatagramReceiver File \Device\NamedPipe\browser File \Device\NamedPipe\browser File C: File \Device\NamedPipe\ntsvcs File \Device\KSENUM#00000001\{9B365890-165F-11D0-A195-0020AFD156E4} File \Device\Termdd File \Device\Termdd File \Device\Tcp File \Device\Termdd File \Device\Termdd File \Device\Ip File \Device\NamedPipe\Ctx_WinStation_API_service File \Device\NamedPipe\Ctx_WinStation_API_service File \Device\Tcp File \Device\Afd\Endpoint File \Device\Ip File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805 File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805 File \Device\Ip File C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA File C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR File \Device\NamedPipe\wkssvc File C:\WINDOWS\system32 File \Device\Tcp File C:\WINDOWS\Debug\NetSetup.LOG File C:\System Volume Information\tracking.log File C:\$Extend\$ObjId File \Device\ASYNCMAC File \Device\NamedPipe\wkssvc File \Device\NamedPipe\EVENTLOG File \Device\NdisWan File \Device\Mailslot\53cb31a0\UnimodemNotifyTSP File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805 File \Device\NdisTapi File \Device\NdisTapi File \Device\NDProxy File \Device\NDProxy File C:\WINDOWS\system32\h323log.txt File \Device\NamedPipe\ROUTER File \Device\NamedPipe\ROUTER File \Device\WANARP Job \BaseNamedObjects\WmiProviderSubSystemHostJob Key HKLM Key HKLM\SYSTEM\ControlSet001\Services Key HKLM\SOFTWARE\Microsoft\Tracing\RASDLG Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DNSRegisteredAdapters Key HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness Key HKLM\SOFTWARE\Microsoft\Tracing\EAPOL Key HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Key HKLM\SOFTWARE\Microsoft\Tracing\RASTLS Key HKLM\SYSTEM\ControlSet001\Services\RasMan\PPP\EAP\25 Key HKLM\SOFTWARE\Microsoft\Tracing\RASCHAP Key HKLM\SOFTWARE\Microsoft\Tracing\Wlpolicy Key HKCR Key HKLM\SOFTWARE\Microsoft\COM3 Key HKU Key HKCR Key HKU Key HKLM\SOFTWARE\Microsoft\COM3 Key HKLM\SOFTWARE\Microsoft\COM3 Key HKCR\CLSID Key HKCR Key HKLM\SOFTWARE\Microsoft\COM3 Key HKU Key HKLM\SOFTWARE\Microsoft\COM3 Key HKLM\SOFTWARE\Microsoft\COM3 Key HKCR\CLSID Key HKCR Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher Key HKLM\SYSTEM\ControlSet001\Services\lanmanworkstation\parameters Key HKLM\SYSTEM\ControlSet001\Services\lanmanserver\parameters Key HKLM\SOFTWARE\Microsoft\Tracing\tapisrv Key HKLM\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216} Key HKU\.DEFAULT Key HKLM\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses Key HKLM\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions Key HKLM\SYSTEM\ControlSet001\Services\Browser\Parameters Key HKLM\SYSTEM\Setup Key HKLM\SOFTWARE\Microsoft\COM3 Key HKU Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{A8A395B3-B94D-47ED-9631-05CEEB4B5B74} Key HKLM\SOFTWARE\Policies Key HKLM\SYSTEM\ControlSet001\Control\Terminal Server Key HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services Key HKLM\SYSTEM\ControlSet001\Control\Terminal Server\Licensing Core Key HKLM\SYSTEM\ControlSet001\Control\Network\Connections Key HKLM\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000 Key HKLM\SYSTEM\ControlSet001\Services\TermService\Parameters Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness Key HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters Key HKU\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam Key HKU\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache Key HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI Key HKLM\SOFTWARE\Microsoft\Tracing\tapi32 Key HKLM\SOFTWARE\Microsoft\Tracing\KMDDSP Key HKLM\SOFTWARE\Microsoft\Tracing\NDPTSP Key HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9 Key HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5 Key HKLM\SOFTWARE\Microsoft\Tracing\conftsp Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\H323TSP Key HKLM\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000 Key HKLM\SOFTWARE\Microsoft\Tracing\RASMAN Key HKLM\SYSTEM\ControlSet001\Services\Dhcp\Parameters Key HKLM\SOFTWARE\Microsoft\Tracing\PPP Key HKLM\SOFTWARE\Microsoft\Tracing\BAP Key HKLM\SYSTEM\ControlSet001\Services\RasMan\PPP Key HKLM\SOFTWARE\Microsoft\Tracing\RASSPAP Key HKLM\SOFTWARE\Microsoft\Tracing\RASPAP Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters Key HKLM\SOFTWARE\Microsoft\Tracing\RASEAP Key HKLM\SOFTWARE\Microsoft\Tracing\RASCCP Key HKLM\SOFTWARE\Microsoft\Tracing\RASBACP Key HKLM\SYSTEM\ControlSet001\Services\Dhcp\Parameters\Options Key HKLM\SOFTWARE\Microsoft\Tracing\RASIPHLP Key HKLM\SOFTWARE\Microsoft\Tracing\RASIPCP KeyedEvent \KernelObjects\CritSecOutOfMemoryEvent Mutant \BaseNamedObjects\RasPbFile Mutant \BaseNamedObjects\ShimCacheMutex Mutant \BaseNamedObjects\RasPbFile Mutant \BaseNamedObjects\0CADFD67AF62496dB34264F000F5624A Mutant \BaseNamedObjects\4FCC0DEFE22C4f138FB9D5AF25FD9398 Mutant \BaseNamedObjects\238FAD3109D3473aB4764B20B3731840 Mutant \BaseNamedObjects\SRDataStore Mutant \BaseNamedObjects\SRDataStore Mutant \BaseNamedObjects\WINMGMT_MARSHALLING_SERVER Mutant \BaseNamedObjects\WINMGMT_KEEP_NEW_CLIENTS_AT_BAY Mutant \BaseNamedObjects\WINMGMT_ACTIVE Mutant \BaseNamedObjects\746bbf3569adEncrypt Mutant \BaseNamedObjects\RAS_MO_02 Mutant \BaseNamedObjects\RAS_MO_01 Port \RPC Control\wzcsvc Port \RPC Control\OLE3 Port \RPC Control\AudioSrv Port \RPC Control\keysvc Port \XactSrvLpcPort Port \RPC Control\tapsrvlpc Port \RPC Control\senssvc Port \RPC Control\trkwks Port \ThemeApiPort Port \RPC Control\srrpc Port \FusApiPort Port \SmSsWinStationApiPort Port \RPC Control\IcaApi Process sgmain.exe(2272) Process zapro.exe(2240) Process sgbhp.exe(2288) Process msmsgs.exe(3876) Process OUTLOOK.EXE(3816) Process firefox.exe(232) Process WINWORD.EXE(3960) Process winlogon.exe(584) Process winlogon.exe(584) Process winlogon.exe(584) Process winlogon.exe(584) Process shstat.exe(468) Process svchost.exe(832) Process DVDRegionFree.exe(2592) Process vsmon.exe(1420) Process explorer.exe(1808) Process explorer.exe(1808) Process explorer.exe(1808) Process UpdaterUI.exe(376) Process csrss.exe(560) Process ctfmon.exe(676) Process ADGJDet.exe(996) Process EM_EXEC.EXE(544) Process CTHELPER.EXE(1388) Process qttask.exe(932) Process opware32.exe(116) Process winlogon.exe(584) Process TeaTimer.exe(1660) Process explorer.exe(1808) Process procexp.exe(3680) Process svchost.exe(832) Process (2460) Process svchost.exe(832) Process swdoctor.exe(1844) Process getright.exe(2196) Section \BaseNamedObjects\__R_000000000007_SMem__ Section \BaseNamedObjects\mmGlobalPnpInfo Section \BaseNamedObjects\SENS Information Cache Section \BaseNamedObjects\ShimSharedMemory Section \BaseNamedObjects\RotHintTable Section \BaseNamedObjects\Wmi Provider Sub System Counters Semaphore \BaseNamedObjects\PowerProfileRegistrySemaphore Semaphore \BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D} Thread svchost.exe(832): 1556 Thread svchost.exe(832): 2108 Thread svchost.exe(832): 2532 Thread svchost.exe(832): 2524 Thread svchost.exe(832): 2520 Thread svchost.exe(832): 2536 Thread svchost.exe(832): 2540 Thread svchost.exe(832): 2524 Thread svchost.exe(832): 2532 Thread svchost.exe(832): 2536 Thread svchost.exe(832): 2540 Thread svchost.exe(832): 1992 Thread svchost.exe(832): 860 Thread svchost.exe(832): 2184 Thread svchost.exe(832): 3796 Thread svchost.exe(832): 3804 Thread svchost.exe(832): 880 Thread svchost.exe(832): 892 Thread svchost.exe(832): 1060 Thread svchost.exe(832): 1064 Thread svchost.exe(832): 1068 Thread svchost.exe(832): 1072 Thread svchost.exe(832): 1076 Thread svchost.exe(832): 1076 Thread svchost.exe(832): 1080 Thread svchost.exe(832): 1084 Thread svchost.exe(832): 1088 Thread svchost.exe(832): 1080 Thread svchost.exe(832): 1092 Thread svchost.exe(832): 1096 Thread svchost.exe(832): 1088 Thread (2460): 2456 Thread svchost.exe(832): 1096 Thread svchost.exe(832): 836 Thread svchost.exe(832): 1140 Thread svchost.exe(832): 1140 Thread svchost.exe(832): 1144 Thread svchost.exe(832): 1152 Thread svchost.exe(832): 1228 Thread svchost.exe(832): 1204 Thread svchost.exe(832): 1212 Thread svchost.exe(832): 1216 Thread svchost.exe(832): 1556 Thread svchost.exe(832): 3940 Thread svchost.exe(832): 2760 Thread svchost.exe(832): 3700 Thread svchost.exe(832): 1412 Thread svchost.exe(832): 1152 Thread svchost.exe(832): 892 Thread svchost.exe(832): 2184 Thread svchost.exe(832): 1464 Thread svchost.exe(832): 1040 Thread svchost.exe(832): 1504 Thread svchost.exe(832): 1508 Thread svchost.exe(832): 1508 Thread svchost.exe(832): 1480 Thread svchost.exe(832): 1484 Thread svchost.exe(832): 1480 Thread svchost.exe(832): 1488 Thread svchost.exe(832): 844 Thread svchost.exe(832): 1552 Thread svchost.exe(832): 2760 Thread svchost.exe(832): 1040 Thread svchost.exe(832): 1728 Thread svchost.exe(832): 848 Thread svchost.exe(832): 1040 Thread svchost.exe(832): 1824 Thread svchost.exe(832): 1828 Thread svchost.exe(832): 1876 Thread svchost.exe(832): 1076 Thread svchost.exe(832): 1952 Thread svchost.exe(832): 860 Thread svchost.exe(832): 252 Thread svchost.exe(832): 240 Thread svchost.exe(832): 1144 Thread svchost.exe(832): 384 Thread svchost.exe(832): 1704 Thread svchost.exe(832): 2064 Thread svchost.exe(832): 1144 Thread svchost.exe(832): 236 Thread svchost.exe(832): 252 Thread svchost.exe(832): 3732 Thread explorer.exe(1808): 184 Thread svchost.exe(832): 1956 Thread svchost.exe(832): 860 Thread svchost.exe(832): 1704 Thread svchost.exe(832): 2068 Thread svchost.exe(832): 2068 Thread svchost.exe(832): 2072 Thread svchost.exe(832): 2080 Thread svchost.exe(832): 2076 Thread svchost.exe(832): 2080 Thread svchost.exe(832): 876 Thread svchost.exe(832): 2092 Thread svchost.exe(832): 2096 Thread svchost.exe(832): 2100 Thread svchost.exe(832): 2104 Thread svchost.exe(832): 2104 Thread svchost.exe(832): 876 Thread svchost.exe(832): 2064 Token NT AUTHORITY\SYSTEM Token BIKE-AGMFI29MFZ\Rod Token BIKE-AGMFI29MFZ\Rod Token BIKE-AGMFI29MFZ\Rod Token NT AUTHORITY\SYSTEM Token NT AUTHORITY\SYSTEM Token NT AUTHORITY\SYSTEM Token BIKE-AGMFI29MFZ\Rod Token BIKE-AGMFI29MFZ\Rod Token BIKE-AGMFI29MFZ\Rod Token BIKE-AGMFI29MFZ\Rod WaitablePort \Security\TRKWKS_PORT WaitablePort \NLAPublicPort WaitablePort \NLAPrivatePort WindowStation \Windows\WindowStations\Service-0x0-3e7$ WindowStation \Windows\WindowStations\SAWinSta WindowStation \Windows\WindowStations\SAWinSta