Great point... are those uniquely named based on the application installed? That might be a nice, oblique way of checking if a particular program is installed.
It seems to me that's a good theory of what it might be looking for, as GUIDs should make good triggers. I wonder if this reduces the search space enough to make brute force feasible now.
