WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\0520_9597866810567.doc
2864rundll32.exe rundll32.exe c:\users\test22\appdata\roaming\microsoft\word\startup\rem.r,ESLMJYVFMJX
6928svchost.exe C:\Windows\System32\svchost.exe
6420