Analysis
- max time kernel
150s - max time network
149s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:28
Static task
static1
Behavioral task
behavioral1
Sample
e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe
- Size 8.9MB
- Sample201109-n18wekdkma
- SHA256 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1
- MD5 ae086d0d666c0baa7c2018227c213023
- SHA1 7473bb65f0e44277f87c910573bc8170279ed671
- SHA512 8a05ef37400c4a89e85fdc08d58c8321d553cc92c2cd1ff8877061ed96b9beece6253f609204bff5ad9ce5615a25eb0610d6682a1e24b92acaef1782b1493c55
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1984 svchost.exe - Sets file execution options in registry 2 TTPs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe" e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - JavaScript code in executable 1 IoCs
resource yara_rule behavioral1/files/0x00040000000130e1-1.dat js - Drops file in System32 directory 336 IoCs
description ioc Process File created C:\Windows\SysWOW64\EhStorAuthn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ROUTE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TapiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_neutral_b94eb92e8150fa35\vmicsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\attrib.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\makecab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\regedt32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wusa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\autoconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mmc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\at.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\expand.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\lodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fontview.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mshta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\runonce.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\tracerpt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\svchost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\taskmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dialer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dnscacheugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\doskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\icacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\net1.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\tcmsetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wsmprovhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\migwiz\MigSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ARP.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sdchange.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wermgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\winrshost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\xlog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Utilman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\bootcfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\colorcpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\getmac.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\grpconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\NAPSTAT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rasphone.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\xcopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\credwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\NETSTAT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\systray.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\diskcopy.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\hh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\logman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\psr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\regini.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDCT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\auditpol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\reg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\bthudtask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\certutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\raserver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\regsvr32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SearchIndexer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\srdelayed.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\drvinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\eventvwr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\hdwwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\newdev.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\perfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\printui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dfrgui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SetIEInstalledDate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SndVol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cmdl32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ctfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\diskraid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dvdupgrd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RpcPing.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PushPrinterConnections.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\shrpubw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wuapp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\regedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\explorer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\winrs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\winver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\whoami.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\ditrace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cmmon32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\LocationNotifications.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\netsh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\resmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Ribbons.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\runas.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\user.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PATHPING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\control.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\proquota.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wevtutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Bubbles.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\calc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dplaysvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\eudcedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RmClient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\unregmp2.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cttunesvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\isoburn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rasdial.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\setupugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wininit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\xwizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\where.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\choice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\efsui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\print.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\subst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sxstrace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\syskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cleanmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\OptionalFeatures.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\timeout.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sbunattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dccw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sdbinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sort.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wlanext.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\migwiz\mighost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\bitsadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dllhst3g.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\logagent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sethc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\write.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\format.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ktmutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Magnify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Netplwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ntkrnlpa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wimserv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDSVR.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mountvol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mspaint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\scrnsave.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cipher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\icardagt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\relog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\replace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\userinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\w32tm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Robocopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\chcp.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cttune.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\driverquery.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\gpupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mcbuilder.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\notepad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\pcaui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\instnm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\msra.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\odbcconf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PkgMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\com\comrepl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\diskperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fsutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\icsunattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\poqexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sdiagnhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dcomcnfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\finger.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\iscsicli.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\taskkill.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\BrmfRsmg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\iscsicpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\label.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\msfeedssync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\MuiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\shutdown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\verclsid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ssText3d.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\clip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ddodiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\DeviceProperties.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\msdt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cmdkey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fixmapi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TRACERT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ntprint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sfc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Mystify.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RegisterIEPKEYs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\setup16.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\setupSNK.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\vssadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mode.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMESC5\IMSCPROP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\forfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mfpmp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rekeywiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\migwiz\migwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\autofmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\diantz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Dism.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\gpscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ntoskrnl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDADM.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\autochk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ipconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ocsetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\setx.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\taskeng.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\unlodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\xpsrchvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\comp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\DpiScaling.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\netiougc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SyncHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wiaacmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dllhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ieUnatt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TSTheme.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\chkdsk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\extrac32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\netbtugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\powercfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rrinstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\diskcomp.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\MigAutoPlay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\nslookup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\tzutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPUEX.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\tree.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\MRINFO.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_amd64_neutral_67b5984f8e8ff717\BrmfRsmg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\certreq.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ftp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\iexpress.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mtstocom.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\typeperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\msiexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\recover.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\com\MigRegDB.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\diskpart.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dpapimig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\find.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RMActivate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SecEdit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\takeown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cmstp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\eventcreate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mstsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\openfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rundll32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\secinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\chkntfs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\more.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\odbcad32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\waitfor.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\migwiz\PostMig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\AtBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dvdplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\esentutl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\perfhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ReAgentc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\systeminfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\net.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\fsquirt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dxdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\findstr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rasautou.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\verifier.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WerFault.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wowreg32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cliconfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\DisplaySwitch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fltMC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\upnpcont.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wextract.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\AdapterTroubleshooter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\convert.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dpnsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mobsync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\osk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\prevhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\DWWIN.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\help.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ndadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\tasklist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TpmInit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\charmap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\compact.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\gpresult.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PresentationHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\schtasks.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - Drops file in Program Files directory 439 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\sidebar.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\sidebar.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Internet Explorer\ieinstal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Mail\wab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Mail\WinMail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\wmpenc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePage.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplateRTL.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\MCABOUT.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Hand Prints.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsVersion1Warning.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\DVD Maker\DVDMaker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmpenc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Internet Explorer\iexplore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Soft Blue.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OSPP.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsMacroTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmprph.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUNGLE.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsColorChart.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\setup_wm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Shades of Blue.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsFormTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePage.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\SEAMARBL.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender\MSASCui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\WMPSideShowGadget.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsColorChart.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmpshare.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{A281FEAF-27B6-47DD-B77C-12C478D10099}\86.0.4240.111_chrome_installer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewFrame.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPrintTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{A281FEAF-27B6-47DD-B77C-12C478D10099}\CR_02A57.tmp\setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBlankPage.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Journal\PDIALOG.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\README.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmplayer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Green Bubbles.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Mail\wabmig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewFrame.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsVersion1Warning.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Mail\WinMail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsImageTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Internet Explorer\ielowutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Mail\wab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\WMPDMC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PAWPRINT.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\WMPDMC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\Welcome.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PINELUMB.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPrintTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Orange Circles.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPrintTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsMacroTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewFrame.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\7-Zip\7z.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Journal\Journal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsImageTemplate.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsDoNotTrust.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\CLNTWRAP.HTM e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\RepairPush.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Google\Temp\GUMCEA4.tmp\GoogleUpdateSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - Drops file in Windows directory 1632 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_96421d40c0e2903e\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_6.1.7601.17514_none_244e76d61e1989e5\SndVol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_6.1.7600.16385_none_33e01c5875c2e5cb\iscsicpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-vault_31bf3856ad364e35_6.1.7600.16385_none_4d5e025e54ba15f8\VaultCmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_6.1.7601.17514_none_7d0125c85cc31d2a\rdpinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.5.7601.17514_none_1f3413afc64d10c5\wuauclt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_32e02520f8081891\WSManHTTPConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_7addf2001d014646\dpnsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\subst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpenc_31bf3856ad364e35_6.1.7600.16385_none_a3fa8a7d892f3cc9\wmpenc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_7.2.7601.23317_none_d2699443d2b69246\winrshost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\tracerpt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-pnpui_31bf3856ad364e35_6.1.7600.16385_none_bacc830144fa7791\dinotify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_51e5e402131afc4a\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-international-core_31bf3856ad364e35_6.1.7600.16385_none_459f562ff37206dd_muiunattend.exe_1e11bb40 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_c8df7823424473a1_netbtugc.exe_825f4f74 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.1.7601.17514_none_1457169844ae9574\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..ce-useractionrecord_31bf3856ad364e35_6.1.7600.16385_none_32c4b0bc55387f75\psr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\CreateDisc\SonicResources\ClickMe.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-4.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\ehmsas.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_6.1.7600.16385_none_b444164f1eecd3f2\cacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_4019f2b8d860ad30\autochk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_dfsvc_b03f5f7f11d50a3a_6.1.7600.16385_none_3a54952b454a8916\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_6.1.7600.16385_none_a0a25363eee12f40\colorcpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_92dafd34e62c3942\weather.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\412.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_brmfcmf.inf_31bf3856ad364e35_6.1.7600.16385_none_6f8740b92fea8e01\BrmfRsmg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehprivjob_31bf3856ad364e35_6.1.7601.17514_none_53393627486ae37b\ehprivjob.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ipconfig_31bf3856ad364e35_6.1.7600.16385_none_a82ee2a7319fa8f8\ipconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..yer-sideshow-gadget_31bf3856ad364e35_6.1.7600.16385_none_841e9494c8a32794\WMPSideShowGadget.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_6.1.7600.16385_none_ae2743278c281682\net.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_6.1.7600.16385_none_5120bf8b19591afa\pcwrun.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-vault_31bf3856ad364e35_6.1.7600.16385_none_4d5e025e54ba15f8\VaultSysUi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7601.17514_none_726f4033dc35da15\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\iissetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-waitfor_31bf3856ad364e35_6.1.7600.16385_none_125aa78894e49f8f\waitfor.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_d18028273214fa77\SearchIndexer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_6.1.7600.16385_none_13b9b4b7d327a721\wmpnscfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wusa_31bf3856ad364e35_6.1.7601.17514_none_0b2696ec2f3c656d\wusa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_5197fbf234706563\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_d7ce65f32404434b\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.1.7601.17514_none_a505d556c9de886a_rstrui.exe_dfa7225b e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_9d700972113e2691\wowreg32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-whoami_31bf3856ad364e35_6.1.7600.16385_none_ce52d479e329be32\whoami.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d158ae10876efd6d\currency.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_6.1.7601.17514_none_ab379671230b963f\bitsadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_6.1.7600.16385_none_ea0a643b0e032c19\CompMgmtLauncher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-diskraid_31bf3856ad364e35_6.1.7601.17514_none_c3afa97fae99bbe4\diskraid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_6.1.7600.16385_none_ad5854ca0a23343d\umount.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_6.1.7601.17514_none_0d44b8d3df1c79a9\imjpuexc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-migrationengine_31bf3856ad364e35_6.1.7601.17514_none_5aaf419e398215df\mighost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e\expand.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_5cbb962a4f0d58c1\comp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661\smss.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_7.2.7601.16406_none_e237a9baed4f587b\WSManHTTPConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_7.2.7601.23317_none_c3591f8284be9456_winmgmt.exe_8f8eb7b1 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-credwiz_31bf3856ad364e35_6.1.7600.16385_none_9fb106cecd28b3f9\credwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-write_31bf3856ad364e35_6.1.7600.16385_none_5f5928533e6b72c0\write.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\svchost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\ehExtHost32.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_02bb0612dc529329\diantz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_8.0.7600.16385_none_7d25450501edb94f\ielowutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\SvcIni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_6.1.7601.17514_none_a1636a92177e3020\prevhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..pwindowmanager-core_31bf3856ad364e35_6.1.7601.17514_none_ebc99983d3d18578_dwm.exe_04cf416e e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_addinprocess_b77a5c561934e089_6.1.7601.17514_none_f9a5b9a7f0e068e4\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_32e02520f8081891\wsmprovhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-getmac_31bf3856ad364e35_6.1.7600.16385_none_0bd4ecde034ea7da\getmac.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-3.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Bears.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_63dee2821fc69fce\bridgeunattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_6.1.7601.17514_none_58b4153116c17b41\RDVGHelper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.23317_none_dbfa66c7ad6615bb\mofcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a6285ac2a45ae884\picturePuzzle.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-6.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Soft Blue.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-client_31bf3856ad364e35_6.1.7600.16385_none_c80d81c947c7b794\HelpPane.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_bd4644e077251730\cmdl32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_ieexec_b03f5f7f11d50a3a_6.1.7600.16385_none_53678ee8c3f93f6b\IEExec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..-downlevel.binaries_31bf3856ad364e35_6.3.9600.16428_none_5faf8886ff3d65d0\MsSpellCheckingFacility.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-secinit_31bf3856ad364e35_6.1.7600.16385_none_e3ace21ee6af3fb6\secinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_wsatconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_dd3a06567424a01b\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-rpc-ping_31bf3856ad364e35_6.1.7600.16385_none_9d906433a20c1949\RpcPing.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_6.1.7601.17514_none_bf7bea0454c3f0cf\bcdboot.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_8.0.7600.16385_none_d009281f9a108e04\mshta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_6.1.7600.16385_none_494ba66d2a12efc3\Netplwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-openfiles_31bf3856ad364e35_6.1.7600.16385_none_431b58a8041530aa\openfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_6.1.7600.16385_none_2b2984d40648fbe7\Locator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_722b680e4b585656\winrshost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.2.9600.16428_none_eab4546b9b62b250\wextract.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_brmfcwia.inf_31bf3856ad364e35_6.1.7600.16385_none_11493a3982b640b7\BrmfRsmg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7601.17514_none_d4c5c995fb3f4a1b\audiodg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_5a768666c3091014\dw20.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-w..etwork-setup-wizard_31bf3856ad364e35_6.1.7600.16385_none_fb26c75d92790b8f\setupSNK.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ervicing-management_31bf3856ad364e35_6.1.7600.16385_none_5e7ff93b6f0000b7\Dism.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ktmutil_31bf3856ad364e35_6.1.7600.16385_none_88604e41627c6de1\ktmutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-proquota_31bf3856ad364e35_6.1.7601.17514_none_29ce61c2f0a740f4\proquota.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_6.1.7600.16385_none_3580dea4def227d4\esentutl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_cb3bc16fc2624947\rasdial.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_6.1.7600.16385_none_761ad65676427bd9\sdiagnhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7601.17514_none_905283bdc3e1d2d8\audit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-computerdefaults_31bf3856ad364e35_6.1.7600.16385_none_064cf7cf249d0026\ComputerDefaults.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_9edcb4a706944d0a\autoconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-extrac32_31bf3856ad364e35_6.1.7600.16385_none_dafff0c26538f91f\extrac32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.1.7601.17514_none_1c140627131a6df3\mcbuilder.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_6.1.7600.16385_none_5ae7f926deb5de01\rdrleakdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\GlobalSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\twunk_16.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_6.1.7601.17514_none_fb3795fb0be32033\WUDFHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a_winresume.exe_85cd1215 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a_vdsldr.exe_20c491b3 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_6.1.7600.16385_none_d96243212694b69e\esentutl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fdddo_31bf3856ad364e35_6.1.7600.16385_none_b0de2afe4ca7a1e2\DeviceDisplayObjectProvider.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_6.1.7600.16385_none_c09aa5b3bec88beb\BdeUISrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad_unlodctr.exe_69df45bb e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7601.17514_none_df7c5af777ec4541_drvinst.exe_6593e92a e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ddodiag_31bf3856ad364e35_6.1.7600.16385_none_362ce835fe42421b\ddodiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-es-authentication_31bf3856ad364e35_6.1.7600.16385_none_419312c477ec702a\EhStorAuthn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\PkgMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-deployment_31bf3856ad364e35_6.1.7600.16385_none_57e3e87206ff08ca\setupugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_244ae8599e6d81bb\hh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskmgr_31bf3856ad364e35_6.1.7601.17514_none_7288349cbfd37b08\taskmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_009cfaa696afe78b\fc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7601.17514_none_71c62979c253e895\RMActivate_ssp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_wcf-icardagt_exe_31bf3856ad364e35_6.1.7600.16385_none_31ae00ebd2fb34b5\icardagt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\500-13.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fontview_31bf3856ad364e35_6.1.7600.16385_none_a058fee6d0280cab\fontview.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\WinMail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrmEngine.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_f9257e7aaa4290ce\ctfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.23317_none_d1a5bc75790553c0\WMIADAP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ipconfig_31bf3856ad364e35_6.1.7600.16385_none_4c104723794237c2\ipconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_6.1.7601.17514_none_0d6fabd7def3be93\PushPrinterConnections.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Boot\PCAT\memtest.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_6.1.7600.16385_none_924b83b9b69fb351\ddodiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mapi_31bf3856ad364e35_6.1.7601.17514_none_097346be305f3966\fixmapi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\PkgMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_6.1.7600.16385_none_f5b8f3d6a353fa89\SnippingTool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ConvertInkStore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winver_31bf3856ad364e35_6.1.7600.16385_none_12466fe3b629e036\winver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_58326e688d4907c6\WFServicesReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\write.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647\appidpolicyconverter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_6.1.7600.16385_none_d3720895f8f22acd\TpmInit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vssservice_31bf3856ad364e35_6.1.7601.17514_none_b8f2d3e62e76fe08\VSSVC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_42ee5aff60183c81_iscsicli.exe_20e14d4f e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_7.2.7601.16406_none_8b3cdd6176daf1a5\powershell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_aeb1ef0f4e6bba1d\cscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-snmp-agent-service_31bf3856ad364e35_6.1.7601.17514_none_5faf9128a3432508\snmp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-control_31bf3856ad364e35_6.1.7600.16385_none_99424f610bd169de\control.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-secinit_31bf3856ad364e35_6.1.7600.16385_none_878e469b2e51ce80\secinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\svchost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehvid_31bf3856ad364e35_6.1.7601.17514_none_a98ec3ba6b5b3e54\ehvid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\MigAutoPlay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-utilman_31bf3856ad364e35_6.1.7600.16385_none_5e9ea1964aee5579\Utilman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_6.1.7601.17514_none_d9bafd47cdf9833b\WinSAT.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_6.1.7601.17514_none_cc9e34fd4e687b15\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.2.9600.16428_none_856219b9f734bb75\iexplore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_6.1.7600.16385_none_2d26f786c50448ba\MigRegDB.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_6.1.7601.17514_none_9809be824da2c173\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\500-18.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Speech\Common\sapisvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-services-ehrecvr_31bf3856ad364e35_6.1.7601.17514_none_1b8f8373383de46a\ehrecvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskkill_31bf3856ad364e35_6.1.7600.16385_none_8172f0ac75c192a6\taskkill.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ftp_31bf3856ad364e35_6.1.7601.17514_none_aef2c7dbb6cc16c1\ftp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFontCac#\0246845f487e5f33d3564eff578665a3\PresentationFontCache.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_ca4e9bcdcac7feed\ntoskrnl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tzutil_31bf3856ad364e35_6.1.7601.17514_none_9269da4819c69a89\tzutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-eventcreate_31bf3856ad364e35_6.1.7600.16385_none_d53926c7a0e7716d\eventcreate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-rundll32_31bf3856ad364e35_6.1.7600.16385_none_d7dba7b30c3e2855\rundll32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c99bfc6ddd1bf1d2\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-forfiles_31bf3856ad364e35_6.1.7600.16385_none_b1186146f739d0f1\forfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..integration-support_31bf3856ad364e35_6.1.7600.16385_none_8429bbdebd38db4a\isintsup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_6.1.7600.16385_none_e3c88f07d4c88269\InetMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..cationnotifications_31bf3856ad364e35_6.1.7600.16385_none_737951ab23cf8ea0\LocationNotifications.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_6.1.7600.16385_none_c50af05b1be3aa2b\powershell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_6.1.7600.16385_none_b6cb9ed71c8b43d5\SystemPropertiesPerformance.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_7.2.7601.23317_none_6323e0c8b24e1492\scrcons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13_wininit.exe_7a527f28 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.1.7600.16385_none_81d82fe9c216eb89\pcaui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-time-tool_31bf3856ad364e35_6.1.7601.17514_none_ef1085419a309311\w32tm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\HelpPane.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_6.1.7601.17514_none_f1fca1ab90570e8a\MdSched.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_934d08d31b96d4ee\sdchange.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_6.1.7601.17514_none_4777e36e0649406c\RMActivate_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7601.17514_none_905283bdc3e1d2d8\Setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_17330d9420bf24e8_expand.exe_f43b24c8 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24_ndadmin.exe_8e57269f e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_6.1.7600.16385_none_38dc646bf68909f4\cmdkey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\psxrun.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\shrpubw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a6285ac2a45ae884\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\dfsvc.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_6.1.7600.16385_none_4befc8eb38093bb1\cttunesvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-wmpenc_31bf3856ad364e35_6.1.7600.16385_none_00192601418cadff\wmpenc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-osk_31bf3856ad364e35_6.1.7600.16385_none_06b1c513739fb828\osk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedt32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-adaptertroubleshooter_31bf3856ad364e35_6.1.7600.16385_none_d1d79dd7e49a786f\AdapterTroubleshooter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-anytime-upgradeui_31bf3856ad364e35_6.1.7600.16385_none_4aadf3be188c056d\WindowsAnytimeUpgradeui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_6.1.7601.17514_none_843a86a1bc33fcd1\bfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_17330d9420bf24e8\expand.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..ion-telemetry-agent_31bf3856ad364e35_6.1.7601.17514_none_3092574c7d41010b\aitagent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_7.2.7601.23317_none_135f5c47ce1fa956\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_7.2.7601.23317_none_50e2d902fb21d1c2\powershell_ise.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7601.17514_none_227e1c01642654f4_wermgr.exe_d92a3b6c e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_edmgen_b77a5c561934e089_6.1.7601.17514_none_cddf79f7120d371d\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\MediaCenterWebLauncher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7601.18010_none_86608c5a70f925bc\taskhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx35linq-addinutil_31bf3856ad364e35_6.1.7601.17514_none_29443e96f9fb6564\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-charmap_31bf3856ad364e35_6.1.7600.16385_none_4e4eaf05be0c2d8f\charmap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018\lodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018\unlodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-com-complus-ui_31bf3856ad364e35_6.1.7600.16385_none_b07e19d8a98c26cf\dcomcnfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\401-4.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_8.0.7601.17514_none_7a9a2f07e4e23a48\ConfigureIEOptionalComponents.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\chcp.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-13.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_6.1.7601.17514_none_81e99da174638311\dxdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_6d6b3cfb6a5a1e5a\ndadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-runas_31bf3856ad364e35_6.1.7600.16385_none_bbdd3aeb771e694e\runas.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\qappsrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_f59e20ddece8f922_certenrollctrl.exe_9495aa75 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_7.2.7601.23317_none_5b3783552f8293bd\powershell_ise.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-filtermanager-utils_31bf3856ad364e35_6.1.7600.16385_none_1964092586ab4352\fltMC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_4b57445488ba33fd\IMJPDADM.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ocsetup_31bf3856ad364e35_6.1.7601.17514_none_41a3376575e751b4\ocsetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..inboxgames-checkers_31bf3856ad364e35_6.1.7601.17514_none_d467c138cbce0b24\chkrzm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-snmp-evntcmd_31bf3856ad364e35_6.1.7600.16385_none_14f9b9481db6293b\evntcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_8.0.7601.17514_none_4abf71c398c9a7d6\ExtExport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..line-user-interface_31bf3856ad364e35_6.1.7600.16385_none_dcbdc8e83e2b98be\cmdkey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-9.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_3e69140a61f1eff5_hdwwiz.exe_b6a1c2df e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-wpd-shellextension_31bf3856ad364e35_6.1.7601.17514_none_13305696250bcb70\WPDShextAutoplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\500.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_regasm_b03f5f7f11d50a3a_6.1.7601.17514_none_a3c349b4bdac0898\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_powershell-gac-tool_exe_31bf3856ad364e35_7.2.7601.16406_none_db2819acc898b633\PSCustomSetupInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-net-command-line-tool_31bf3856ad364e35_6.1.7600.16385_none_5208a7a3d3caa54c\net.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sonic-clickme_31bf3856ad364e35_6.1.7600.16385_none_560dd693a7476c8c\ClickMe.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_32a601ad2b7a554f\PDMSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_6.1.7600.16385_none_f9aeffb75a698a7f\RpcPing.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-vssadmin_31bf3856ad364e35_6.1.7600.16385_none_c453ab9392f73dca\vssadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-international-core_31bf3856ad364e35_6.1.7600.16385_none_459f562ff37206dd\MuiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_6.1.7601.17514_none_832fc1bb7d681e0d\sdclt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-soundrecorder_31bf3856ad364e35_6.1.7601.17514_none_fd2f4b124982e400\SoundRecorder.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\qprocess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_6.1.7600.16385_none_8733bee404f7386c\sfc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_en-us_39b468a7491888f2\calendar.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\fveupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\wow\ehexthost32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_6.1.7600.16385_none_0adc1fc1cb6f944b\SecEdit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_092d6b9141f16aca\WinMgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-com-complus-setup_31bf3856ad364e35_6.1.7600.16385_none_e97e2f6c50a1c3c0\mtstocom.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_95f92198f65d354d\driverquery.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_a907fb2af12e5dc6\PATHPING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_9d700972113e2691_wowreg32.exe_94fc2d06 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_servicemodelreg_b03f5f7f11d50a3a_6.1.7601.17514_none_1f2918adb8a9c100\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\IMEPADSV.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx35linq-addinprocess_31bf3856ad364e35_6.1.7601.17514_none_8ebd3037635a8b2f\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-choice_31bf3856ad364e35_6.1.7600.16385_none_c33d412fed16819c\choice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\splwow64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-robocopy_31bf3856ad364e35_6.1.7601.17514_none_252d34f00303c6fa\Robocopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_6.1.7600.16385_none_498d334c14a3b9bb\hwrcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-writewin_31bf3856ad364e35_6.1.7600.16385_none_378836c309ee380e\write.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_720e868d9b0b6a44\WerFault.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mobsyncexe_31bf3856ad364e35_6.1.7601.17514_none_f1584379b2973708\mobsync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-wlan-extension_31bf3856ad364e35_6.1.7600.16385_none_f9b9855184ad1e6d\wlanext.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-xcopy_31bf3856ad364e35_6.1.7600.16385_none_62cc00cc559fd4ec\xcopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-6.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\Narrator.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_7.2.7601.23317_none_3309223e19327f8f\WmiPrvSE.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_a0c922c3b170dd5d\RegisterIEPKEYs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\PkgMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wcf-smsvchost_b03f5f7f11d50a3a_6.1.7600.16385_none_c7f13af70ac77b22\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7_ntkrnlpa.exe_165c312a e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-timeout_31bf3856ad364e35_6.1.7600.16385_none_8c3ac2e4279846be\timeout.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_6.1.7600.16385_none_243595ae2cf3193f\TsWpfWrp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_6.1.7601.17514_none_9757fd443892abe7\inetinfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msdt_31bf3856ad364e35_6.1.7600.16385_none_0177539a37378025\msdt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7\dnscacheugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_c718d071d9c10a2d\auditpol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24\ndadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_7.2.7601.16406_none_d1ea0f3eb9916a9f\winrshost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\twunk_32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_b94cbfa183466a89\winresume.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\ARP.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_36bc61b12dcec80c\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-securestartup-notify_31bf3856ad364e35_6.1.7600.16385_none_78e75d04c1b0c873\fvenotify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.5.7601.17514_none_b9a4b88eb4255dbf\wuapp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-commandlinehelp_31bf3856ad364e35_6.1.7600.16385_none_d4018bc76a8b37d9\help.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\IMCCPHR.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-installer-executable_31bf3856ad364e35_6.1.7601.17514_none_4b88deb7e45bfbb0\msiexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-netsh_31bf3856ad364e35_6.1.7600.16385_none_5f774c61592c67c3\netsh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\ehtray.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_6.1.7601.17514_none_c3b917fd89d834f3\LogonUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_6.1.7600.16385_none_533d797efdf7728b\SystemPropertiesAdvanced.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7601.17514_none_d527b0a5438b8346_drvinst.exe_6593e92a e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-taskkill_31bf3856ad364e35_6.1.7600.16385_none_25545528bd642170\taskkill.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\mode.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-f..opycompareutilities_31bf3856ad364e35_6.1.7600.16385_none_d9573758d681d8ec\diskcopy.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_6.1.7601.17514_none_895a2b74415ea575\DismHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7600.16385_none_5702948e8e63fc30\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-icacls_31bf3856ad364e35_6.1.7600.16385_none_8ea990b7bfab3802\icacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_6.1.7600.16385_none_84db2473005c51cb\MdRes.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_a0cf62efee3228a3\wab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.23317_none_d1a5bc75790553c0\WmiApSrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_7.2.7601.23317_none_ed0bd9123ad5421d\wsmprovhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_wpf-xamlviewer_31bf3856ad364e35_6.1.7600.16385_none_55e4a2a4de407800\XamlViewer_v0300.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-jsc_b03f5f7f11d50a3a_6.1.7600.16385_none_14e6e9dab736481d\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sxs_31bf3856ad364e35_6.1.7601.17514_none_b0540607b5e5d445\sxstrace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\servicing\TrustedInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_divacx64.inf_31bf3856ad364e35_6.1.7600.16385_none_cf37cc4c5bc25dc7\xlog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\chgusr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\logoff.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MSASCui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wpf-xamlviewer_31bf3856ad364e35_6.1.7601.17514_none_b43451f0938c6cd0\XamlViewer_v0300.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7601.17514_none_04d9defd57c1f6bf\rrinstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-14.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\ehvid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_ce2d22115368db7a\WerFault.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_6.1.7601.17514_none_7df14b591094e7ec\TsUsbRedirectionGroupPolicyControl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-waitfor_31bf3856ad364e35_6.1.7600.16385_none_b63c0c04dc872e59\waitfor.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..pwindowmanager-core_31bf3856ad364e35_6.1.7601.17514_none_ebc99983d3d18578\dwm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-peertopeercollab_31bf3856ad364e35_6.1.7600.16385_none_f32a402a46d391f3\p2phost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-whoami_31bf3856ad364e35_6.1.7600.16385_none_2a716ffd9b872f68\whoami.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-ngen_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_046c078df2caf5d8\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_e24a7886a9947ebf_hdwwiz.exe_b6a1c2df e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_6.1.7600.16385_none_ca61f601a4548b8e\_isdel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad\perfhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_9da1b3254ff796e9\sdchange.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\401-3.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\NETFXRepair.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_6.1.7600.16385_none_94861149bb66249c\powershell_ise.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..xing-service-server_31bf3856ad364e35_6.1.7601.17514_none_0db5e5844ed6ffe9\CISVC.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7601.17514_none_0c19cef0ed2a642e\setup_wm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_a45d44bd1a0af822\wscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_6.1.7600.16385_none_58257acb668f62bc\cacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_e6af0acbde467b7b\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\more.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\DHtmlHeader.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-14.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\dfsvc\bb4a1994db088e84b9d383271b082250\dfsvc.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\misc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-lua_31bf3856ad364e35_6.1.7601.17514_none_047062a1736af5b9\consent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_23376bf5921e7b63\auditpol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_acd03d9b9048bd78\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\servicing\GC64\tzupd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_6.1.7600.16385_none_6d0100c50efddc3c\RunLegacyCPLElevated.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_b9c82ac6f7db99ae\where.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-security-spp_31bf3856ad364e35_6.1.7601.17514_none_78875ce737927d27_sppsvc.exe_fc6922a9 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-international-core_31bf3856ad364e35_6.1.7601.17514_none_ebb1ce7438031941_muiunattend.exe_1e11bb40 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-bootconfig_31bf3856ad364e35_6.1.7600.16385_none_0becd32d7b9ba9e5\bootcfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-credwiz_31bf3856ad364e35_6.1.7600.16385_none_fbcfa2528586252f\credwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_6.1.7601.17514_none_696354579779eadf\imjpuexc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_6.1.7601.17514_none_fa2fc39ab7937a51\resmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_52db65a773b633fd\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_6.1.7601.17514_none_4f18faed6aae2509\bitsadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.2.9600.16428_none_828666943772c435\msfeedssync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_msbuild_b03f5f7f11d50a3a_3.5.7600.16385_none_8c3cf176a8e91487\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mystify_31bf3856ad364e35_6.1.7601.17514_none_f21904fdbd9f5e08\Mystify.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\notepad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_6.1.7600.16385_none_c8897566b5c070a0\InfDefaultInstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_a0cf62efee3228a3\wabmig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_6.1.7600.16385_none_0184794e7b5db540\dvdplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\attrib.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dbfc68edd3137610\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_a018e05d0d33081d\dllhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\icsunattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_3899b0ad2bb77a86_iscsicli.exe_20e14d4f e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_11.2.9600.16428_none_eace14b8d6178cca\SetIEInstalledDate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_6.1.7601.17514_none_4d76defd6af4a83e\mobsync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_6.1.7600.16385_none_4c045ec8fda52d34\fveprompt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\iexplore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_02aa6dd4294b8d5f\shutdown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Shades of Blue.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\msouc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\shadow.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_6.1.7600.16385_none_a6c7190f7292676c\scrcons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_73e472e09a1a05d1\wmpshare.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_6.1.7601.17514_none_331c32d99bebbdac\mip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\appcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_6.1.7601.17514_none_c0e644688bbad892\sethc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ShapeCollector.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\WmiApSrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7601.17514_none_61acd141e5332baf\wmpnetwk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.22091_none_d0d0722c3bb0dc09\setup16.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_6.1.7600.16385_none_e9dfd464f0c2ad1f\comrepl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\SvcIni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8734fb86705288a7\flyout.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-12.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_bd4644e077251730\cmstp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_infocard_b77a5c561934e089_6.1.7601.17514_none_583a8c60c0b305a1\infocard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-7.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_975df0a6f5a54628\gpupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17514_none_ca56670fcac29ca9\ntoskrnl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.16406_none_d12637705fe02c19\unsecapp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.2.9600.16428_none_b436382b203656be\ExtExport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-15.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cipher_31bf3856ad364e35_6.1.7600.16385_none_090b7101bec9a9e2\cipher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_4b57445488ba33fd\IMJPDCT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_8b52bb03d4ea5d36\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-cipher_31bf3856ad364e35_6.1.7600.16385_none_acecd57e066c38ac\cipher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_6.1.7601.17514_none_884c69064922f75b\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-13.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_6.1.7600.16385_none_a044d905576812d4\odbcad32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..protection-statusui_31bf3856ad364e35_6.1.7600.16385_none_998ff5c741ae3fb1\NAPSTAT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-regini_31bf3856ad364e35_6.1.7600.16385_none_684b2e15d381ea25\regini.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_fed8c13f0d90a8cf\WinMgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-efs-ui_31bf3856ad364e35_6.1.7600.16385_none_f64b1e25e8ea1172\efsui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17514_none_6e37cb8c12652b73\ntkrnlpa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sethc_31bf3856ad364e35_6.1.7601.17514_none_64c7a8e4d35d675c\sethc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-10.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7601.17514_none_3471a890d8284f57\spoolsv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-driververifier_31bf3856ad364e35_6.1.7600.16385_none_ba42313afe0efbbb\verifier.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_6.1.7600.16385_none_6ff39cfbb8057a05\cliconfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-choice_31bf3856ad364e35_6.1.7601.17514_none_218cf07ba262766c\choice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.1.7600.16385_none_87a28b30f517e40e\printfilterpipelinesvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-snmp-evntwin_31bf3856ad364e35_6.1.7600.16385_none_12c5b5b81f2d2f1d\evntwin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\chgport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-telnet-server-tlntsess_31bf3856ad364e35_6.1.7600.16385_none_05ebf19ca2304436\tlntsess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_c718d071d9c10a2d_auditpol.exe_83c870f4 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_160ccc8a92fae520\winrshost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\MSBuild.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_eventviewersettings_31bf3856ad364e35_6.1.7600.16385_none_50ecc9ae1d642aa9\eventvwr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_7.2.7601.16406_none_e237a9baed4f587b\wsmprovhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_7.2.7601.16406_none_efcd9e3cc3e6f289\wbemtest.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_7.2.7601.23317_none_ed0bd9123ad5421d\WSManHTTPConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_6.1.7600.16385_none_10e2654156a06b06\RunLegacyCPLElevated.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Orange Circles.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fax-service_31bf3856ad364e35_6.1.7601.17514_none_0b499f2c96e8f6b2\FXSSVC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\migwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..tomizationsnonwinpe_31bf3856ad364e35_6.1.7601.17514_none_29f4eed2a5d64c25\PnPUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_6.1.7600.16385_none_207247174b54af00\vssadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad\lodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.17514_none_da3cb85562df73c9\memtest.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-grouppolicy-script_31bf3856ad364e35_6.1.7600.16385_none_64ed8ea5d0ffd85e\gpscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..opycompareutilities_31bf3856ad364e35_6.1.7600.16385_none_3575d2dc8edf4a22\diskcopy.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\tskill.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_6.1.7601.17514_none_5e47617f33c574ac\SMConfigInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.22091_none_d0d0722c3bb0dc09\instnm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_6.1.7601.17514_none_8b399e33ba72bed9\twunk_32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_6.1.7600.16385_none_c405852b31194b0b\certreq.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..xing-service-server_31bf3856ad364e35_6.1.7601.17514_none_0db5e5844ed6ffe9\CIDAEMON.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_6.1.7600.16385_none_851e6308c5b62529\quser.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_7.2.7601.16406_none_85707cb7609e5eec\Register-CimProvider.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_infocard_b77a5c561934e089_6.1.7601.17514_none_9fe7c337d52f2ea7\infocard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_6f1d25ec0a04d811\rasdial.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-extrac32_31bf3856ad364e35_6.1.7600.16385_none_371e8c461d966a55\extrac32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_6.1.7601.17514_none_1229a6f0546e2346\lpr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_6.1.7600.16385_none_8be8919a8f43b3f6\raserver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.1.7601.17514_none_a505d556c9de886a\rstrui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_b94cbfa183466a89_winload.exe_75835076 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_51bcbc61a5466a58\CertEnrollCtrl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_6.1.7600.16385_none_d7c180d4bd657495\iscsicpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_fbf2cfb573e03306\takeown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\MRINFO.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\Fonts\GlobalMonospace.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Bears.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\loadmxf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_cb604f1aa758e6b6\IMJPMGR.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_6.1.7600.16385_none_8094bd7b62d2b435\ImagingDevices.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_6.1.7600.16385_none_47357ddedbb9dec6\logagent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7601.17514_none_0c19cef0ed2a642e\unregmp2.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..boxgames-backgammon_31bf3856ad364e35_6.1.7600.16385_none_668d031845881638\bckgzm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\InputPersonalization.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-deviceproperties_31bf3856ad364e35_6.1.7600.16385_none_ea20b9269b3c9a2c\DeviceProperties.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mountvol_31bf3856ad364e35_6.1.7600.16385_none_b22fcf90b2c6e173\mountvol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\accicons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_6.1.7600.16385_none_5da314d233bb2676\dvdplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-snmp-agent-service_31bf3856ad364e35_6.1.7601.17514_none_555ae6d66ee2630d\snmp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_6.1.7601.17514_none_a54b31331066c8e2\Dxpserver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.1.7601.17514_none_1202940e4711971e\plasrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\tscon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_7.2.7601.23317_none_28b477ebe4d1bd94\WmiPrvSE.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6_netbtugc.exe_825f4f74 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7601.17514_none_df7c5af777ec4541\drvinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7601.17514_none_37575b7e71a86712\sbunattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nslookup_31bf3856ad364e35_6.1.7601.17514_none_29a6795f7d1218c6\nslookup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7601.17514_none_8664adc870f5633a\taskhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\user.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-cttune_31bf3856ad364e35_6.1.7600.16385_none_b35ae2951fd8adbc\cttune.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPDCT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_6.1.7600.16385_none_40d0db63344deff9\SystemPropertiesHardware.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6d7d60ea24be809c\slideShow.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_7.2.7601.23317_none_8167b8145b9f5751\powershell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicepackcoordinator_31bf3856ad364e35_6.1.7601.17514_none_92e727843e307e1b\spinstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_6.1.7601.17514_none_6f4ef219dd693ca6\WPDShextAutoplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-certutil_31bf3856ad364e35_6.1.7600.16385_none_b55b5e1094b0283d\certutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_6.1.7600.16385_none_247621f7aa7542ff\ImagingDevices.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8734fb86705288a7\RSSFeeds.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\mcGlidHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a\winresume.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.7600.16385_none_a61138e7aab17fed\ieUnatt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-cttunesvr_31bf3856ad364e35_6.1.7600.16385_none_efd12d677fabca7b\cttunesvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-defrag-adminui_31bf3856ad364e35_6.1.7601.17514_none_9b1d78a9ee870c74\dfrgui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-fsutil_31bf3856ad364e35_6.1.7600.16385_none_cc3a6a9c514031a2\fsutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7fddcd6a1ab604da\clock.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\ehexthost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_6.1.7600.16385_none_c10c2a29895d4994\gpscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a\vds.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_7.2.7601.23317_none_7b9b576a4562c498\Register-CimProvider.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\WMIADAP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_6.1.7600.16385_none_2831d06e8295c671\upnpcont.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_11.2.9600.16428_none_ae214da780801b0f\RegisterIEPKEYs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Garden.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\wmpconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_6.1.7601.17514_none_ff1b74d24817a82b\RMActivate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_7.2.7601.16406_none_2e08aac271eedbd5\winrshost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0246f6465cb859ba\picturePuzzle.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\config.json e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\misc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..otservicing-utility_31bf3856ad364e35_6.1.7600.16385_none_d139a2cea567ce3f\fveupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7600.16385_none_7c6ba3bd1f954290_wermgr.exe_d92a3b6c e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-msdt_31bf3856ad364e35_6.1.7600.16385_none_0bcbfdec6b984220\msdt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\401-5.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_6.1.7601.17514_none_e6510234bbcb2a8c\bcdedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_msbuild_b03f5f7f11d50a3a_3.5.7601.17514_none_ea8ca0c25e350957\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_sdbinst.exe_8725e339 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_6.1.7601.17514_none_8b399e33ba72bed9\twunk_16.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-winver_31bf3856ad364e35_6.1.7600.16385_none_b627d45ffdcc6f00\winver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Fonts\GlobalSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\ehExtHost.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7600.16385_none_7c6ba3bd1f954290\wermgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_6.1.7601.17514_none_a7a77a3b9cb96ce6\msiexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_288b7acec3a75696\WSManHTTPConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_b94cbfa183466a89_winresume.exe_85cd1215 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmdl32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\nfsadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7fddcd6a1ab604da\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_6.1.7601.17514_none_e46b048a01806891\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_6.1.7600.16385_none_ad5854ca0a23343d\mount.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a\vdsldr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\more.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2b166002b7f51771\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_6.1.7600.16385_none_459ccaf008ff34f6\mtstocom.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\shrpubw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a_rasautou.exe_477abe34 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-regini_31bf3856ad364e35_6.1.7600.16385_none_0c2c92921b2478ef\regini.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-vb_compiler_b03f5f7f11d50a3a_6.1.7601.17514_none_144b6bd462e4a41b\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-10.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-autofmt_31bf3856ad364e35_6.1.7601.17514_none_441a424cd5cda219\autofmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-irftp_31bf3856ad364e35_6.1.7600.16385_none_b2af329397f29f60\irftp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7601.17514_none_ba1c770af0b2031b\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wpf-globalsansserifcf_31bf3856ad364e35_6.1.7600.16385_none_aa406b6315304084\GlobalSansSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-mcglidhost_31bf3856ad364e35_6.1.7600.16385_none_05a2b72417ec1c6a\mcGlidHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.7600.16385_none_6425238b793ee910\PDMSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_6.1.7600.16385_none_5e9e78a6dd413413\sapisvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sxs_31bf3856ad364e35_6.1.7601.17514_none_0c72a18b6e43457b\sxstrace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_ddef5417d55eb944\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-diskraid_31bf3856ad364e35_6.1.7601.17514_none_67910dfbf63c4aae\diskraid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_regasm_b03f5f7f11d50a3a_6.1.7601.17514_none_eb70808bd228319e\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.23317_none_d1a5bc75790553c0\unsecapp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\McrMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_6.1.7601.17514_none_d71fb1d63f05ef22\WFS.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-grpconv_31bf3856ad364e35_6.1.7600.16385_none_fe7d1685575edfa6\grpconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_6.1.7600.16385_none_f8a40495785334a9\PrintIsolationHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7601.17514_none_2d02b12c3d47a517\sidebar.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_6.1.7600.16385_none_55d820d53d0a8fa3\wlanext.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_6f1d25ec0a04d811\rasphone.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_6.1.7600.16385_none_f71eddfb459a0155\SystemPropertiesAdvanced.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mystify_31bf3856ad364e35_6.1.7601.17514_none_4e37a08175fccf3e\Mystify.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\406.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\500-15.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\ehprivjob.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_f0686b7ca6acde00\mpnotify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\WsatConfig\9683999d889dc0b8782c782e2fc1aee5\WsatConfig.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7601.18079_none_58f7a9fa8b7ece01\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_975df0a6f5a54628\gpresult.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_6.1.7600.16385_none_696bcc240bce3ca9\odbcconf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\poqexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647_appidpolicyconverter.exe_83972af0 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-deployment_31bf3856ad364e35_6.1.7601.17514_none_fdf660b64b901b2e\setupugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-runas_31bf3856ad364e35_6.1.7600.16385_none_5fbe9f67bec0f818\runas.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Green Bubbles.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_6.1.7600.16385_none_7582a4a93f08b488\fltMC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-tcpip_31bf3856ad364e35_6.1.7601.17514_none_bfab9b4ba5f934f9_netiougc.exe_94123cfe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_76239aafb364e805_rasautou.exe_477abe34 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_6.1.7601.17514_none_04846decebf43c4c\resmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\mofcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_a69c6a8f23f521f3\diantz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_d2fff1dae966863c\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_92dafd34e62c3942\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\502.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..ce-useractionrecord_31bf3856ad364e35_6.1.7600.16385_none_8ee34c400d95f0ab\psr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_6.1.7601.17514_none_e1cb175aef3b13bb\UserAccountControlSettings.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_c8df7823424473a1\netbtugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_720e868d9b0b6a44\WerFaultSecure.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6d7d60ea24be809c\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-5.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7601.22252_none_598fe67da49281af\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_c1fead4e4bf85947\IMTCPROP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_6.1.7601.17514_none_8375605f8afb0c19\wmlaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_73e472e09a1a05d1\wmplayer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_6.1.7600.16385_none_d63cc4dd74a11d0b\DpiScaling.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fsutil_31bf3856ad364e35_6.1.7600.16385_none_28590620099da2d8\fsutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_6.1.7600.16385_none_d44c0ef849349ed9\regsvr32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7601.17514_none_7a2ff57a626c29fd\SpeechUXTutorial.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_7.2.7601.16406_none_62a45bc39928eceb\scrcons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-atbroker_31bf3856ad364e35_6.1.7600.16385_none_cf7705f47fa8cd65\AtBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-migration_31bf3856ad364e35_6.1.7600.16385_none_0e3c9ce5e73a7257\imjppdmg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_d6876629731ce419\PDMSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-label_31bf3856ad364e35_6.1.7600.16385_none_570561eb2b9c151d\label.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\mode.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-16.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_6.1.7600.16385_none_8fbb77bb3cd808d1\pcalua.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-anytime-upgrade_31bf3856ad364e35_6.1.7600.16385_none_fb591b6cf023ade3\WindowsAnytimeUpgrade.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_6.1.7600.16385_none_cc12387f7062eb3b\cliconfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7601.17514_none_f387767e655cd5ab\cmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-dpiscaling_31bf3856ad364e35_6.1.7600.16385_none_7a1e2959bc43abd5\DpiScaling.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_7f0c7a3c17077fce\wextract.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Boot\DVD\PCAT\etfsboot.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7601.17514_none_736d5be520319b24\tzupd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_6.1.7600.16385_none_b4e9027a5234f127\xwizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\icsunattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig\9a69a26417a09c2d9d7f67bf7592bd74\ComSvcConfig.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_8.0.7601.17514_none_617c25c51f43e03f\ieinstal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-networkprojection_31bf3856ad364e35_6.1.7600.16385_none_3fbc74d90a6e33f8\NetProj.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-eudcedit_31bf3856ad364e35_6.1.7601.17514_none_5b9fee911dc04044\eudcedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-fontview_31bf3856ad364e35_6.1.7600.16385_none_443a636317ca9b75\fontview.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\PkgMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Peacock.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_6.1.7601.17514_none_7f7f66788318015d\lpremove.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_bd4644e077251730\cmmon32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-runonce_31bf3856ad364e35_6.1.7601.17514_none_73e0da0bd5a77c41\runonce.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-srdelayed_31bf3856ad364e35_6.1.7600.16385_none_5633adf6bd7b303e\srdelayed.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wpf-globaluserinterfacecf_31bf3856ad364e35_6.1.7600.16385_none_09f32bc9cd996ba2\GlobalUserInterface.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8a5c3d2bac37e9\ntoskrnl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\MigSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_347a450f0c8bd52d\printui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_cb3bc16fc2624947\rasphone.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_6.1.7601.17514_none_533cd4f8150e6a86\RMActivate_ssp_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sigverif_31bf3856ad364e35_6.1.7600.16385_none_178e7604150fa952\sigverif.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..executionprevention_31bf3856ad364e35_6.1.7600.16385_none_c9b9bfc685ed05d3\SystemPropertiesDataExecutionPrevention.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-snmp-evntcmd_31bf3856ad364e35_6.1.7600.16385_none_b8db1dc46558b805\evntcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3\csrss.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_3e69140a61f1eff5\hdwwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7601.17514_none_cde4c4fd7ab159cb\RMActivate_ssp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7601.17514_none_905283bdc3e1d2d8\setupsqm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_6.1.7601.17514_none_4c8976380e00631f\WMPDMC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_caspol_b03f5f7f11d50a3a_6.1.7601.17514_none_f885d1129806720d\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_2129f6bd1f6002ae\DFDWiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_6.1.7600.16385_none_a0d95afc49c833b6\dispdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_5cbb962a4f0d58c1\fc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_6.1.7600.16385_none_b70694aa97134f37\rdrleakdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_6.1.7601.17514_none_036ad230212a39ce\lsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_addinutil_b77a5c561934e089_6.1.7601.17514_none_1a816bc7556b71eb\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4008824c98f8edac\dnscacheugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\doskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\instnm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\GlobalMonospace.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_6.1.7601.17514_none_625ebded763bbe23\ssText3d.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_6.1.7601.17514_none_412fcd2afecdc412\mqsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.1.7600.16385_none_622070221822eb39\PurblePlace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Fonts\GlobalSansSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\logman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\posix.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.17514_none_da3cb85562df73c9_memtest.exe_01d80391 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\ROUTE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\hh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_bth.inf_31bf3856ad364e35_6.1.7601.17514_none_d06ac9aad230c1d6\fsquirt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-control_31bf3856ad364e35_6.1.7600.16385_none_f560eae4c42edb14\control.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.2.9600.16428_none_46d2efef53c02386\iexpress.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rundll32_31bf3856ad364e35_6.1.7600.16385_none_33fa4336c49b998b\rundll32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_7.2.7601.16406_none_2e08aac271eedbd5\winrs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad_perfhost.exe_df3332ad e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7601.18079_none_634c544cbfdf8ffc\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-clip_31bf3856ad364e35_6.1.7600.16385_none_a7b238407d550501\clip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_6.1.7601.17514_none_2d3b8ff08901343f\DismHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-findstr_31bf3856ad364e35_6.1.7601.17514_none_2936f54db7f6c08f\findstr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_7.2.7601.23317_none_d2699443d2b69246\winrs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\500-17.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_6.1.7601.17514_none_113aea0e8374286d\djoin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_6.1.7601.17514_none_e2a1ffe0ca40cff2_recdisc.exe_20690b49 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.2.9600.16428_none_1c0dbd69636d746a\ieUnatt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\tracerpt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-8.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-migration_31bf3856ad364e35_6.1.7600.16385_none_6a5b38699f97e38d\imjppdmg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..iuminboxgames-chess_31bf3856ad364e35_6.1.7600.16385_none_d0c99374981840d5\Chess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-inkwatson_31bf3856ad364e35_6.1.7600.16385_none_644c1a991aac9ffb\InkWatson.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.16406_none_db7ae1c29440ee14\WMIADAP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ribbons_31bf3856ad364e35_6.1.7601.17514_none_8abc4ded863e0452\Ribbons.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2b166002b7f51771\RSSFeeds.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970\clrgc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4008824c98f8edac_dnscacheugc.exe_aa32623e e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_009cfaa696afe78b\comp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_addinprocess32_b77a5c561934e089_6.1.7601.17514_none_df35b5ac03866e22\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7601.17514_none_fa8534ab236134c4\rrinstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_narrator_31bf3856ad364e35_6.1.7601.17514_none_e18f9f5aaa2eda72\Narrator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_6.1.7600.16385_none_a1802b822e2a878c\WMIC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_44b0c76c35d4b76d\wabmig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_divacx64.inf_31bf3856ad364e35_6.1.7600.16385_none_cf37cc4c5bc25dc7\ditrace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gettingstarted_31bf3856ad364e35_6.1.7600.16385_none_dc7256ed0ded6c12\GettingStarted.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\showmount.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_6.1.7600.16385_none_bac291589d407fde\TFTP.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_6.1.7601.17514_none_935e5e07aa28aa00\rdpsign.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728_printui.exe_bb673fff e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-certificaterequesttool_31bf3856ad364e35_6.1.7600.16385_none_67e6e9a778bbd9d5\certreq.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_f5276fe6b5adf276\clrgc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_wpf-presentationhostexe_31bf3856ad364e35_6.2.7601.17514_none_3a2a6a811d2b5065\PresentationHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8734fb86705288a7\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\WsatConfig.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_6.1.7600.16385_none_48b6a2a03e2c7b21\DisplaySwitch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_ce2d22115368db7a\WerFaultSecure.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..mes-spidersolitaire_31bf3856ad364e35_6.1.7600.16385_none_dead260d8f002b73\SpiderSolitaire.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_6.1.7601.17514_none_848b402bf3e1c3b1\wksprt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\HOSTNAME.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_8.0.7600.16385_none_da5dd271ce714fff\mshta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\401.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_6.1.7601.17514_none_f73c142da6e47daa\dfrgui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\ROUTE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661_smss.exe_d7209c3a e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-shell-previewhost_31bf3856ad364e35_6.1.7601.17514_none_4544cf0e5f20beea\prevhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\SMSvcHost.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_d6fc8d83d55eb77c\dpnsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.1.7601.17514_none_7832a1aacb77df29\mcbuilder.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\rwinsta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Temp\PendingRenames\60201da15eadd601ee090000d003d40c.amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_7.2.7601.16406_none_b884f02b3738aab4_winmgmt.exe_8f8eb7b1 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Stars.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.2.9600.16428_none_11b913172f0cb26f\ieUnatt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wordpad_31bf3856ad364e35_6.1.7601.17514_none_963528f4b7e5d0fd\wordpad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.7601.17514_none_190fa02cb006154d\msfeedssync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mapi_31bf3856ad364e35_6.1.7601.17514_none_ad54ab3a7801c830\fixmapi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_6.1.7600.16385_none_9d299157e03ce00f\klist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_ca4e9bcdcac7feed_ntoskrnl.exe_0fb0ab79 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad_lodctr.exe_b02cefba e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\iissetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4d6aa30008b38d10\cpu.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-11.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\ComSvcConfig.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netsh_31bf3856ad364e35_6.1.7600.16385_none_bb95e7e51189d8f9\netsh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_f0686b7ca6acde00_wlrmdr.exe_f8ebac58 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_7.2.7601.23317_none_1db4069a02806b51\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPUEX.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\chcp.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Narrator\4cc02fad33053737088d4c18267ca0a0\Narrator.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.1.7600.16385_none_ddf6cb6d7a745cbf\pcaui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7601.17514_none_e932cc2c30fc13b0\cmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_6.1.7601.17514_none_5ffc161221c1b4f6\rdpclip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_6d6b3cfb6a5a1e5a_newdev.exe_7eb73dcd e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_7.2.7601.16406_none_1d348194e95b43aa\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\SearchFilterHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W71daf281#\5ada68cfa2258a2d4e3c3779106faf9b\Microsoft.Workflow.Compiler.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_a018e05d0d33081d\dllhst3g.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setx_31bf3856ad364e35_6.1.7600.16385_none_086bc77632c16995\setx.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_7.2.7601.16406_none_7b1bd2652c3d9cf1\Register-CimProvider.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-charmap_31bf3856ad364e35_6.1.7600.16385_none_f230138205aebc59\charmap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-directshow-dvdupgrd_31bf3856ad364e35_6.1.7600.16385_none_7d9cbcec3df8da86\dvdupgrd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7\ntkrnlpa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_6.1.7601.17514_none_0b0882245933a065\nfsclnt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedt32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_6.1.7600.16385_none_cf5f9aad50446c26\powershell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-8.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_fafb502abef1be40\autoconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_6.1.7601.17514_none_38a043f2b45f9ad2\msconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7601.17514_none_905283bdc3e1d2d8\oobeldr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_7.2.7601.16406_none_5ab7fe50165d6c16\powershell_ise.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cttune_31bf3856ad364e35_6.1.7600.16385_none_0f797e18d8361ef2\cttune.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-session0viewer_31bf3856ad364e35_6.1.7600.16385_none_3ddbd9a9605f0519\UI0Detect.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-lua_31bf3856ad364e35_6.1.7601.17514_none_047062a1736af5b9_consent.exe_9075a1c2 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_eventviewersettings_31bf3856ad364e35_6.1.7600.16385_none_5b41740051c4eca4\eventvwr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2d7749943fcc6ea3\currency.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-12.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\McxTask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.2.9600.16428_none_dea50217efd0356b\msfeedssync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_6.1.7600.16385_none_25d85b4a3e4a7709\SystemPropertiesDataExecutionPrevention.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_6.1.7600.16385_none_9243b833ecd918df\baaupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7601.22172_none_86ab4a318a459fda\taskhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_6.1.7600.16385_none_5aad0353642dd29f\SystemPropertiesPerformance.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Hand Prints.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_6.1.7600.16385_none_851e6308c5b62529\msg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-timeout_31bf3856ad364e35_6.1.7600.16385_none_e8595e67dff5b7f4\timeout.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_6.1.7600.16385_none_26e76f2ac1492952\wmprph.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_6.1.7601.17514_none_7a09c587c282995a\TabTip32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ocsetup_31bf3856ad364e35_6.1.7601.17514_none_e5849be1bd89e07e\ocsetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_regsvcs_b03f5f7f11d50a3a_6.1.7601.17514_none_be8bab32249b2a4e\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\Fonts\GlobalSansSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_6.1.7600.16385_none_e47ee9c51ad9df17\ktmutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_6.1.7601.17514_none_698e475b97512fc9\PushPrinterConnections.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_6.1.7601.17514_none_e8657d02cbf5e4c1\schtasks.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1_services.exe_abfc33da e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_7.2.7601.16406_none_ec8c540d21b01a76\WSManHTTPConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-devicepairingapp_31bf3856ad364e35_6.1.7600.16385_none_6f74b7d163601da2\DevicePairingWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\Fonts\GlobalSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mountvol_31bf3856ad364e35_6.1.7600.16385_none_0e4e6b146b2452a9\mountvol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_a907fb2af12e5dc6\PING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_6.1.7600.16385_none_74b76d3fa1757c6f\chkntfs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_6.1.7601.17514_none_fa2fc39ab7937a51\perfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_6.1.7601.17514_none_3d9977977190cdc4\MultiDigiMon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_7.2.7601.16406_none_ec8c540d21b01a76\wsmprovhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_mcupdate_31bf3856ad364e35_6.1.7601.17514_none_26c2d72ec26de8d9\mcupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-diskpart_31bf3856ad364e35_6.1.7601.17514_none_c6fe6ac9ac8c7105\diskpart.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\subst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a\rasautou.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_6.1.7600.16385_none_2b7ff0845918e12f\snmptrap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3_csrss.exe_06529458 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad\unlodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-18.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\WsatConfig\36ca2928b2191011831ab673861c6ac6\WsatConfig.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_fafb502abef1be40\convert.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_6.1.7600.16385_none_ff7cf696bfb54620\ucsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-3.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\TCPSVCS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_6.1.7600.16385_none_80543131e5508a75\TsWpfWrp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a_winload.exe_75835076 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-bth-user_31bf3856ad364e35_6.1.7601.17514_none_cd93efad202e5fb6\bthudtask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_73e472e09a1a05d1\wmpconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\user.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-winre-recoverytools_31bf3856ad364e35_6.1.7601.17514_none_d7553e5fcf6b6373\ReAgentc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wcf-icardagt_exe_31bf3856ad364e35_6.1.7600.16385_none_8dcc9c6f8b58a5eb\icardagt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_d18028273214fa77\SearchFilterHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_6.1.7601.17514_none_e99b83c8fd064a06\InetMgr6.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-isoburn_31bf3856ad364e35_6.1.7601.17514_none_4458ac8eafdacbdd\isoburn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-setspn_31bf3856ad364e35_6.1.7600.16385_none_dbfa9310f7d4d925\setspn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_6.1.7601.17514_none_ed7ce39bb395c4e0\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-9.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_1ddb4b87a6618437\chkdsk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systray_31bf3856ad364e35_6.1.7600.16385_none_4f466e7a0fbb1a04\systray.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\NETSTAT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-telnet-server-tlntsvr_31bf3856ad364e35_6.1.7600.16385_none_1ab997fb0a83afdd\tlntsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7601.22252_none_63e490cfd8f343aa\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_6.1.7601.17514_none_c82fdb5265bc18af\SndVol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_6.1.7601.17514_none_ed47f623204af12a\logagent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_6.1.7600.16385_none_304988749d91936f\SystemPropertiesComputerName.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\ARP.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-machine_config_ocm_b03f5f7f11d50a3a_6.1.7601.17514_none_c9a73868d24cb267\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehrec_31bf3856ad364e35_6.1.7600.16385_none_a6e882bc6eb8ea53\ehrec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\TRACERT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_6.1.7600.16385_none_316a8a208c030e56\reg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-certutil_31bf3856ad364e35_6.1.7600.16385_none_1179f9944d0d9973\certutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.1.7600.16385_none_d1124c00155dfd14\Solitaire.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-autochkconfigurator_31bf3856ad364e35_6.1.7600.16385_none_1898d1bbe9180b39\chkntfs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\tree.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-f..opycompareutilities_31bf3856ad364e35_6.1.7600.16385_none_d9573758d681d8ec\diskcomp.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-scrnsave_31bf3856ad364e35_6.1.7600.16385_none_e115f7273bb86d58\scrnsave.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_aeb1ef0f4e6bba1d\wscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_6.1.7600.16385_none_7444913c36004801\sc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_6.1.7601.17514_none_4207fb67165f731a\wbengine.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-notepadwin_31bf3856ad364e35_6.1.7600.16385_none_9ebebe8614be1470\notepad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_3b3f55233d47d4f2\gpresult.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wpf-globalmonospacecf_31bf3856ad364e35_6.1.7600.16385_none_dfe31f7fc9d21b1b\GlobalMonospace.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\flyout.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\explorer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_6.1.7600.16385_none_680b6eb133f91b1b\bootcfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_6.1.7600.16385_none_8945930a7d61b9f0\MigRegDB.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directshow-dvdupgrd_31bf3856ad364e35_6.1.7600.16385_none_d9bb586ff6564bbc\dvdupgrd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_b7aa02fc1797974c\IMTCPROP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\iisrstas.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..lified-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_808c0da292f3ca46\IMSCPROP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Peacock.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_6.1.7600.16385_none_2370c162e00680c3\Defrag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\mofcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_4a83748394a862f9\dialer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.2.9600.16428_none_6ed450a8ee531df1\ieinstal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-mcxtask_31bf3856ad364e35_6.1.7600.16385_none_b6bc1aae9d0693c5\McxTask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\IMCCPHR.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6\netbtugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_6.1.7600.16385_none_c25bebf1075ff6aa\OptionalFeatures.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_6.1.7600.16385_none_7861b83567d966e6\ksetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-bubbles_31bf3856ad364e35_6.1.7601.17514_none_7085b0272833ba88\Bubbles.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\401-2.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sonic-sbeserver_31bf3856ad364e35_6.1.7601.17514_none_7b380cb06fd9d81d\SBEServer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728\printui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_9da1b3254ff796e9\msra.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_7.2.7601.16406_none_c2d99a7d6b996caf\WinMgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_6.1.7600.16385_none_07c100a06d2b74c6\rekeywiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-eventlog-commandline_31bf3856ad364e35_6.1.7600.16385_none_c0aa8bc2de239cf9\wevtutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-optionalfeatures_31bf3856ad364e35_6.1.7600.16385_none_663d506d4f028574\OptionalFeatures.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..e-managed-regmceapp_31bf3856ad364e35_6.1.7600.16385_none_b13a0967547ecab4\RegisterMCEApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-iecleanup_31bf3856ad364e35_11.2.9600.16428_none_a03d6846a99c1c87\iecleanup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_6.1.7600.16385_none_1ddd261c4e350476\upnpcont.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\401-1.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_b45109ec45a678fc\WFServicesReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_43fa44d954d596e7\dllhst3g.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-dpapi-keys_31bf3856ad364e35_6.1.7600.16385_none_7da9291f2ec46948\dpapimig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sctasks_31bf3856ad364e35_6.1.7601.17514_none_8c46e17f1398738b\schtasks.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_99931ad927972550\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-ngen_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_4c193e6507471ede\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-7.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_6.1.7600.16385_none_1c92c4d88ce86757\wmprph.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\typeperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-spp_31bf3856ad364e35_6.1.7601.17514_none_78875ce737927d27\sppsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7600.16385_none_61573ee0c2c4be2b\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7601.17514_none_37575b7e71a86712\sidebar.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.22091_none_d0d0722c3bb0dc09\user.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_6.1.7601.17514_none_412fcd2afecdc412\mqbkup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-4.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\Narrator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bth-user_31bf3856ad364e35_6.1.7601.17514_none_c33f455aebcd9dbb\bthudtask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17514_none_d281ccc018b94ff4\conhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.2.9600.16428_none_a827c83273877b14\ie4uinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_6.1.7600.16385_none_851e6308c5b62529\qwinsta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx35linq-csharp_31bf3856ad364e35_6.1.7601.17514_none_7551b4792ac9630d\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\setup16.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.1.7601.17514_none_f20ae427dbae4faf\ntprint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\b93c627ec2e15c2675bcc81edafb10be\MSBuild.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\ehrecvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_6.1.7600.16385_none_5269b9a9a14782a8\efsui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_6.1.7601.17514_none_326571587836a400\wsqmcons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-synchost_31bf3856ad364e35_6.1.7600.16385_none_c575fec016436d8a\SyncHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\psxss.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-session0viewer_31bf3856ad364e35_6.1.7600.16385_none_3ddbd9a9605f0519_ui0detect.exe_639495e3 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-setx_31bf3856ad364e35_6.1.7600.16385_none_ac4d2bf27a63f85f\setx.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-taskscheduler-engine_31bf3856ad364e35_6.1.7601.17514_none_e7b3b71a1d1c8662\taskeng.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.7601.17514_none_752e3bb068638683\msfeedssync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\wmpshare.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.5.7601.17514_none_af500e3c7fc49bc4\wuapp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_7.2.7601.23317_none_c3591f8284be9456\WinMgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_e3fb573520033bfa\autochk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..flicklearningwizard_31bf3856ad364e35_6.1.7600.16385_none_69769fd78b751ad3\FlickLearningWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-notepad_31bf3856ad364e35_6.1.7600.16385_none_d5642974be118415\notepad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_7.2.7601.16406_none_32899d39000d57e8\WmiPrvSE.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-format_31bf3856ad364e35_6.1.7600.16385_none_827dd459a3aa9980\format.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_6.1.7600.16385_none_3df12febe293ce5d\tcmsetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setupcl_31bf3856ad364e35_6.1.7601.17514_none_b6d50b4301e77815\setupcl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\MigAutoPlay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-5.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-calc_31bf3856ad364e35_6.1.7600.16385_none_05b2f2e2346cfea4\calc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_6.1.7600.16385_none_3157c24b5944e2a3\eventcreate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_6.1.7600.16385_none_bfa748753634ba48\SystemPropertiesProtection.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-ieexec_b03f5f7f11d50a3a_6.1.7600.16385_none_7dfc94f7357c56d2\IEExec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a_vds.exe_cb461c29 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_datasvcutil_b77a5c561934e089_6.1.7601.17514_none_cfdc452bbab5ec47\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\aspnetca.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\IMEPADSV.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-winhstb_31bf3856ad364e35_6.1.7600.16385_none_28dc647c6aba6742\winhlp32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_6.1.7600.16385_none_56e30bcc495bf9ca\LinqWebConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-17.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehshell_31bf3856ad364e35_6.1.7600.16385_none_95955bd51390781b\ehshell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_7.2.7601.16406_none_506353fde1fcaa1b\powershell_ise.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\print.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-pnputil_31bf3856ad364e35_6.1.7600.16385_none_5958b438d6388d15\PnPutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-stickynotes-app_31bf3856ad364e35_6.1.7600.16385_none_493ba8a4d2fc9697\StikyNot.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_msbuild_b03f5f7f11d50a3a_6.1.7601.17514_none_0de23daf595f5711\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_b94cbfa183466a89\winload.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-getmac_31bf3856ad364e35_6.1.7600.16385_none_67f38861bbac1910\getmac.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7601.17514_none_fa8534ab236134c4\mfpmp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_6.1.7601.17514_none_e2a1ffe0ca40cff2\recdisc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496\wowreg32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-wtvconverter_31bf3856ad364e35_6.1.7600.16385_none_a8464accb5a91f59\WTVConverter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\PostMig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\Microsoft.Workflow.Compiler.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..-mctadmin-component_31bf3856ad364e35_6.1.7600.16385_none_672f52a8b504cbbe\mctadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_6d6b3cfb6a5a1e5a\newdev.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_23376bf5921e7b63_auditpol.exe_83c870f4 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\grvicons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehmsas_31bf3856ad364e35_6.1.7600.16385_none_8707c620868fdf75\ehmsas.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_6.1.7601.17514_none_e8f86b1cdf02c483\wpnpinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17514_none_04709031736ac277_lsass.exe_682060de e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPDSVR.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_6.1.7601.17514_none_3d9659600c3683e3\NETFXSBS10.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-11.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_7.2.7601.23317_none_e2b72ec006748022\wsmprovhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-restartmanager_31bf3856ad364e35_6.1.7600.16385_none_800bbdee85723191\RmClient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\PING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wvmic.inf_31bf3856ad364e35_6.1.7601.17514_none_6007c443630c03aa\vmicsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\NETSTAT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_db2b15bfcf64f104\wextract.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-notepad_31bf3856ad364e35_6.1.7600.16385_none_cb0f7f2289b0c21a\notepad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\PATHPING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_6.1.7600.16385_none_33f05b889d506d0a\wbemtest.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_ehexthost32_31bf3856ad364e35_6.1.7600.16385_none_2a78e65a954611a5\ehexthost32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-grpconv_31bf3856ad364e35_6.1.7600.16385_none_a25e7b019f016e70\grpconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_d76c81de4a71c338\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Soft Blue.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_994532c948ec8e69\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..opycompareutilities_31bf3856ad364e35_6.1.7600.16385_none_3575d2dc8edf4a22\diskcomp.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-2.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-15.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_6.1.7600.16385_none_ba9e94bf275d71ed\Dism.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-label_31bf3856ad364e35_6.1.7600.16385_none_b323fd6ee3f98653\label.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sysprep_31bf3856ad364e35_6.1.7600.16385_none_4b73926c122be805\sysprep.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\iisreset.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\migwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_6.1.7601.17514_none_85ac7bd736dda285\UserAccountControlSettings.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-adaptertroubleshooter_31bf3856ad364e35_6.1.7600.16385_none_2df6395b9cf7e9a5\AdapterTroubleshooter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_6.1.7601.17514_none_4afdc98b09e3cfe8\PkgMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_6.1.7601.17514_none_6fb51b358e21d75f\TabTip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-dfsvc_b03f5f7f11d50a3a_6.1.7600.16385_none_96dbb959ba7c7a79\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_installutil_b03f5f7f11d50a3a_6.1.7601.17514_none_4fd3f543ddc446fa\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-calc_31bf3856ad364e35_6.1.7601.17514_none_abc56b2678fe1108\calc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_f47d7472a4c4e67e\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498\AxInstUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sysinfo_31bf3856ad364e35_6.1.7600.16385_none_4b49a2c2123fd42c\systeminfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_7.2.7601.23317_none_2e882fc78b14037c\winrshost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPMGR.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_6.1.7600.16385_none_6388acf17dd74912\SystemPropertiesProtection.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_6.1.7600.16385_none_a9b5c1d91f03e0b4\RelPost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-processmodel_31bf3856ad364e35_6.1.7601.17514_none_1f3c3defefc3a10e\w3wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_6.1.7600.16385_none_44263d819f0aa19e\odbcad32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\WTVConverter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\rpcinfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_6.1.7600.16385_none_8d8925a444607f8c\reg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_6.1.7600.16385_none_8c6823f855ef04a5\SystemPropertiesComputerName.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_7.2.7601.23317_none_e2b72ec006748022\WSManHTTPConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\logman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-taskmgr_31bf3856ad364e35_6.1.7601.17514_none_16699919077609d2\taskmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\oisicon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-driververifier_31bf3856ad364e35_6.1.7600.16385_none_1660ccbeb66c6cf1\verifier.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-findstr_31bf3856ad364e35_6.1.7601.17514_none_855590d1705431c5\findstr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\iisreset.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicepackcoordinator_31bf3856ad364e35_6.1.7601.17514_none_92e727843e307e1b\spreview.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_0f49a133d6f5d42b\mmc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-openfiles_31bf3856ad364e35_6.1.7600.16385_none_e6fcbd244bb7bf74\openfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_a907fb2af12e5dc6\TRACERT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ribbons_31bf3856ad364e35_6.1.7601.17514_none_e6dae9713e9b7588\Ribbons.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\mcspad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-mcweblauncher_31bf3856ad364e35_6.1.7600.16385_none_5846a8771b202706\MediaCenterWebLauncher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_6.1.7600.16385_none_7110452767e88835\xpsrchvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\PostMig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-iecleanup_31bf3856ad364e35_11.2.9600.16428_none_441eccc2f13eab51\iecleanup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-packagemanager_31bf3856ad364e35_6.1.7601.17514_none_eedf2e0751865eb2\PkgMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\GlobalSansSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\SMSvcHost\04d794428d635f6a82ac57dd3d6f3628\SMSvcHost.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_f217bd1caebaa683\driverquery.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_288b7acec3a75696\wsmprovhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-runonce_31bf3856ad364e35_6.1.7601.17514_none_17c23e881d4a0b0b\runonce.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_db2b15bfcf64f104\iexpress.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-telnet-server_31bf3856ad364e35_6.1.7600.16385_none_eefcce9868c6d4b7\tlntadmn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_6.1.7601.17514_none_f4285a06060032a9\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\diskperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..cationnotifications_31bf3856ad364e35_6.1.7600.16385_none_175ab6276b721d6a\LocationNotifications.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\replace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-systray_31bf3856ad364e35_6.1.7600.16385_none_f327d2f6575da8ce\systray.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_6.1.7601.17514_none_301a46c726a4cdc6\repair-bde.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\finger.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip_31bf3856ad364e35_6.1.7601.17514_none_bfab9b4ba5f934f9\netiougc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-autofmt_31bf3856ad364e35_6.1.7601.17514_none_e7fba6c91d7030e3\autofmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-directx-directplay4_31bf3856ad364e35_6.1.7600.16385_none_76e6c1802136b090\dplaysvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-isoburn_31bf3856ad364e35_6.1.7601.17514_none_e83a110af77d5aa7\isoburn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24\newdev.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\SvcIni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\ehshell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.1.7600.16385_none_7547f48c79b40229\msdtc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_d18028273214fa77\SearchProtocolHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_addinprocess32_b77a5c561934e089_6.1.7601.17514_none_83171a284b28fcec\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\change.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_ehexthost_31bf3856ad364e35_6.1.7601.17514_none_c0f01f501d19ea73\ehexthost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_2e9f92abd2ce43b6\hh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.2.9600.16428_none_e8cd1f348648ebd1\ielowutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_6.1.7601.17514_none_e501f8e06b32b48f\net1.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-snmp-provider_31bf3856ad364e35_6.1.7601.17514_none_08e183f8dd5f48b7\smi2smir.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_2e9f92abd2ce43b6_hh.exe_f87e0044 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_6.1.7601.17514_none_04846decebf43c4c\perfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0246f6465cb859ba\settings.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\doskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Fonts\GlobalUserInterface.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.1.7600.16385_none_901eda10f3ab38d2\McrMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_6.1.7601.17514_none_b6cddd21f1df8715\mighost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7601.17514_none_2d02b12c3d47a517\sbunattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.16406_none_d12637705fe02c19\WMIADAP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018_unlodctr.exe_69df45bb e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_7.2.7601.23317_none_b9047530505dd25b_winmgmt.exe_8f8eb7b1 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636_winlogon.exe_ac37d0c5 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_smsvchost_b03f5f7f11d50a3a_6.1.7601.17514_none_e6b622bd1115139e\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\GlobalUserInterface.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..lepc-mobilitycenter_31bf3856ad364e35_6.1.7601.17514_none_b8bffa4921e2a435\mblctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7600.16385_none_9e59e11166b683d3\PDIALOG.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\WinMail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\MRINFO.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_6.1.7600.16385_none_ca61f601a4548b8e\setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_6.1.7600.16385_none_806f80a8aaa33dd4\sdiagnhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3d8bb37f97ba22ff_sdbinst.exe_8725e339 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.7601.17514_none_b296f701dc00c582\ieUnatt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmmon32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_6.1.7600.16385_none_82523ed4cbbd035a_etfsboot.com_ef11feb5 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_729fe3c3da2c920c\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dbfc68edd3137610\clock.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a\winload.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_5ec90957e1a8fe95\shutdown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_6.1.7601.17514_none_0228c5fb7b680376\SMConfigInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_6.1.7600.16385_none_c5e81c6ab4db0c88\TapiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7\ntoskrnl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_aspnet_compiler_b03f5f7f11d50a3a_6.1.7600.16385_none_a5a135380060b978\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_6.1.7600.16385_none_626b9352dcfa715c\ComputerDefaults.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\poqexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_7.2.7601.23317_none_b9047530505dd25b\WinMgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_regsvcs_b03f5f7f11d50a3a_6.1.7601.17514_none_76de745b101f0148\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-synchost_31bf3856ad364e35_6.1.7600.16385_none_cfcaa9124aa42f85\SyncHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\WMIADAP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_e24a7886a9947ebf\hdwwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\poqexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\MSBuild\1a154709cdfe214029ea88c51ab2b579\MSBuild.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_e410f56f6c4ee930\ConfigureIEOptionalComponents.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.2.9600.16428_none_caf2ec2ca6b08f27\ieinstal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.1.7600.16385_none_fe560f0352e04f48\MineSweeper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018_lodctr.exe_b02cefba e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_43fa44d954d596e7\dllhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.7601.17514_none_0a379bcfbdcffb74\PDMSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-2.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\405.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_installutil_b03f5f7f11d50a3a_6.1.7601.17514_none_0826be6cc9481df4\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fax-service_31bf3856ad364e35_6.1.7601.17514_none_0b499f2c96e8f6b2\FXSUNATD.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_3899b0ad2bb77a86\iscsicli.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_6.1.7600.16385_none_b65cdbcf116dd7c5\WMSvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_caa8f7c0e409a91f\ntoskrnl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7601.17514_none_905283bdc3e1d2d8\windeploy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-engine_31bf3856ad364e35_6.1.7601.17514_none_43d2529dd579f798\taskeng.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\mcupdate.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..estartup-fverecover_31bf3856ad364e35_6.1.7600.16385_none_ab0552bceeca5a61\BdeUnlockWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\chglogon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24_newdev.exe_7eb73dcd e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_b466b741b68bd29a\FreeCell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_6.1.7601.17514_none_ef3338f363c6403c\TrustedInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49_wininit.exe_7a527f28 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_loadmxf_31bf3856ad364e35_6.1.7600.16385_none_388de5065074b62c\loadmxf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_9d06e2f6f1e51f98\ctfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17514_none_6e37cb8c12652b73\ntoskrnl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_6.1.7600.16385_none_2b1523604c99c736\sfc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_6.1.7600.16385_none_9db1ae483049e160\EhStorAuthn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_11.2.9600.16428_none_0a3fe92b38dd8c45\RegisterIEPKEYs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_6.1.7600.16385_none_dc2a59723dcfa2c7\RmClient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Temp\PendingRenames\a04fbba25eadd601cf0a0000d003d40c.wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_7.2.7601.16406_none_c2d99a7d6b996caf_winmgmt.exe_8f8eb7b1 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_6.1.7600.16385_none_d03cc6bce93bce83\TapiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_caspol_b03f5f7f11d50a3a_6.1.7601.17514_none_403307e9ac829b13\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-optionaltsps_31bf3856ad364e35_6.1.7600.16385_none_e1d294682a365d27\tcmsetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_6.1.7600.16385_none_de06b4fbd5b45f78\BitLockerToGo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\ehsched.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.22091_none_d2b1c721321aadf8\conhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_6.1.7601.17514_none_7920b60d569a4a1e\wmlaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_6.1.7601.17514_none_864c8948d3a4b9f3\mqtgsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7_dnscacheugc.exe_aa32623e e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_6.1.7601.17514_none_b656fd566c17dc3a\mstsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-compact_31bf3856ad364e35_6.1.7600.16385_none_f9cb90ee16e61ec6\compact.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sysinfo_31bf3856ad364e35_6.1.7600.16385_none_ef2b073e59e262f6\systeminfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Fonts\GlobalMonospace.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\bfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647\appidcertstorecheck.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7601.17514_none_b9e7a42ab571bbb9\slui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\reset.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_6.1.7600.16385_none_31db018394805d6b\TSTheme.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7_ntoskrnl.exe_0fb0ab79 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPDADM.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-n..protection-statusui_31bf3856ad364e35_6.1.7600.16385_none_3d715a438950ce7b\NAPSTAT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\PresentationFontCache.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_6.1.7601.17514_none_3d9977977190cdc4\tabcal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-icacls_31bf3856ad364e35_6.1.7600.16385_none_328af534074dc6cc\icacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7601.17514_none_affb336d34ccf2f8\unregmp2.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\TCPSVCS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-mcspad_31bf3856ad364e35_6.1.7600.16385_none_bd8c328b84ea0fba\mcspad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_6.1.7601.17514_none_b7be8a14d61db17a\eudcedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-ieetwcollector_31bf3856ad364e35_11.2.9600.16428_none_a56da9e617d4f97e\ieetwcollector.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_6.1.7600.16385_none_fa057619380ff901\nbtstat.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netcfg_31bf3856ad364e35_6.1.7600.16385_none_6c23cd5f6b2a8dbc\netcfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wordpad_31bf3856ad364e35_6.1.7601.17514_none_8be07ea283850f02\wordpad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_244ae8599e6d81bb_hh.exe_f87e0044 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dd95cd2390bb17bc\calendar.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Roses.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_6.1.7601.17514_none_ff178cca7f9d03eb\BdeHdCfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_6.1.7600.16385_none_b252497a75d8a174\srdelayed.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_6.1.7601.17514_none_25cb021dbc0611db\dxdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\SMSvcHost\0b4d4e172e8054cb61d27f5ab9e0e445\SMSvcHost.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17932_none_d26a33ec18cb49c4\conhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_8.0.7600.16385_none_7f263a8951bc5a48\SetIEInstalledDate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_narrator-nonmsil_31bf3856ad364e35_6.1.7601.17514_none_8b63c5e0db87fde8\Narrator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7601.17514_none_7a2ff57a626c29fd\SpeechUXWiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-displayswitch_31bf3856ad364e35_6.1.7600.16385_none_ec98071c85cf09eb\DisplaySwitch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Garden.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_6.1.7600.16385_none_cb9353551bbd8ed8\DevicePairingWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-recover_31bf3856ad364e35_6.1.7600.16385_none_e2083f75ce4c0619\recover.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Journal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sort_31bf3856ad364e35_6.1.7600.16385_none_ab9479767ad67fd7\sort.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\LoadMxf.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_6.1.7600.16385_none_463f54aa539a0b62\DeviceProperties.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\relog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3d8bb37f97ba22ff\sdbinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-tcpip_31bf3856ad364e35_6.1.7601.17514_none_ca00459dda59f6f4\netiougc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-international-core_31bf3856ad364e35_6.1.7601.17514_none_ebb1ce7438031941\MuiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_6.1.7601.17514_none_f06adab455a2f1e9\WMPDMC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-clip_31bf3856ad364e35_6.1.7600.16385_none_03d0d3c435b27637\clip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ftp_31bf3856ad364e35_6.1.7601.17514_none_0b11635f6f2987f7\ftp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\find.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_6.1.7601.17514_none_b532bb17fea7ee9a\LinqWebConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_6.1.7600.16385_none_963d3becc3a475f1\raserver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_6d1a8c84bedf66a4\cleanmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_6.1.7600.16385_none_fe75fb7856d846d5\DWWIN.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7601.17514_none_affb336d34ccf2f8\setup_wm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17514_none_04709031736ac277\lsass.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_6.1.7601.17514_none_f8852afc12f84e8e\nltest.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wcf-servicemodelreg_b03f5f7f11d50a3a_6.1.7601.17514_none_40fc6e6d1b4ea992\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_6.1.7601.17514_none_036ad230212a39ce_lsm.exe_ecbd567a e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-security-secedit_31bf3856ad364e35_6.1.7600.16385_none_aebd843e13122315\SecEdit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_7.2.7601.16406_none_d1ea0f3eb9916a9f\winrs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\f4a88265ac4ad47978daef8c5482fd30\MSBuild.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..ime-upgrade-results_31bf3856ad364e35_6.1.7601.17514_none_21de7e134213566a\WindowsAnytimeUpgradeResults.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_6.1.7600.16385_none_44d62330646f757a\DeviceEject.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_6.1.7600.16385_none_2874ea220a5507fd\wiawow64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_6.1.7601.17514_none_2d1a84c49beb2055\wiaacmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Temp\PendingRenames\a04fbba25eadd601c70a0000d003d40c.amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_7.2.7601.16406_none_b884f02b3738aab4_winmgmt.exe_8f8eb7b1 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.1.7601.17514_none_4e297fab940bc0e5\ntprint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_6.1.7601.17514_none_1229a6f0546e2346\lpq.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-ldr64_exe_31bf3856ad364e35_6.1.7600.16385_none_f98e4869675ab367\Ldr64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-makecab_31bf3856ad364e35_6.1.7600.16385_none_f0a5d809ca926e4f\makecab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-terminalservices-theme_31bf3856ad364e35_6.1.7600.16385_none_d5bc65ffdc22ec35\TSTheme.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-1.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_6.1.7600.16385_none_e63ed98817cf16b1\Eap3Host.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_7.2.7601.23317_none_f04d2341dd0c1a30\wbemtest.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx35linq-edmgen_31bf3856ad364e35_6.1.7601.17514_none_0ca1fd81527e1e9a\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_presentationfontcache_31bf3856ad364e35_6.1.7600.16385_none_0da126f11187fafa\PresentationFontCache.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-diskpart_31bf3856ad364e35_6.1.7601.17514_none_6adfcf45f42effcf\diskpart.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-verclsid_31bf3856ad364e35_6.1.7600.16385_none_bbbd275974c7e191\verclsid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7601.17514_none_d527b0a5438b8346\drvinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehtray_31bf3856ad364e35_6.1.7601.17514_none_88ff132e83a8a275\ehtray.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_6.1.7601.17514_none_7f7f66788318015d\lpksetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_powershell-gac-tool_exe_31bf3856ad364e35_7.2.7601.23317_none_d152f45fad5d1bdf\PSCustomSetupInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-forfiles_31bf3856ad364e35_6.1.7600.16385_none_54f9c5c33edc5fbb\forfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-robocopy_31bf3856ad364e35_6.1.7601.17514_none_c90e996c4aa655c4\Robocopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-utilman_31bf3856ad364e35_6.1.7600.16385_none_028006129290e443\Utilman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winhlp32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_402eca316047a0fe\dialer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.16406_none_d12637705fe02c19\mofcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_aspnet_regsql_b03f5f7f11d50a3a_6.1.7600.16385_none_2461659e78807255\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\e88db1688b08fbb889b0b9d4b1a51493\SMSvcHost.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\tsdiscon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-processmodel_31bf3856ad364e35_6.1.7601.17514_none_14e7939dbb62df13\w3wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..inboxgames-shanghai_31bf3856ad364e35_6.1.7600.16385_none_1c98ed5d08db04ce\Mahjong.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-syskey_31bf3856ad364e35_6.1.7600.16385_none_74578a893f33207c\syskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_f0686b7ca6acde00_mpnotify.exe_bd6992f8 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_36bc61b12dcec80c\weather.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\CreateDisc\SBEServer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_6.1.7600.16385_none_d9c7c4a2e721da7e\dpapimig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_6.1.7601.17514_none_d71fb1d63f05ef22\FXSCOVER.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_7.2.7601.16406_none_80e8330f427a2faa\powershell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_a45d44bd1a0af822\cscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_6.1.7600.16385_none_1426830c3ebb712d\telnet.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_7.2.7601.23317_none_2e882fc78b14037c\winrs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_powershell-gac-tool_exe_31bf3856ad364e35_7.2.7601.16406_none_d0d36f5a9437f438\PSCustomSetupInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\typeperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_6.1.7601.17514_none_f71e39745cb0f950\RMActivate_ssp_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-security-syskey_31bf3856ad364e35_6.1.7600.16385_none_1838ef0586d5af46\syskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-t..acyinkingcomponents_31bf3856ad364e35_6.1.7600.16385_none_41c821eeeae8dea2\pipanel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-machine_config_ocm_b03f5f7f11d50a3a_6.1.7601.17514_none_81fa0191bdd08961\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_6.1.7600.16385_none_3d3492aaf415de8e\scrnsave.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\500-16.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e_expand.exe_f43b24c8 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_3b3f55233d47d4f2\gpupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\501.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-atbroker_31bf3856ad364e35_6.1.7600.16385_none_2b95a17838063e9b\AtBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eudc-settings_31bf3856ad364e35_6.1.7601.17514_none_b84dc938eed78546\eudcsettings.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\aspnetca.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-at_31bf3856ad364e35_6.1.7600.16385_none_4cd7fa8ce5381b26\at.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-nslookup_31bf3856ad364e35_6.1.7601.17514_none_cd87dddbc4b4a790\nslookup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\mcupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\wmplayer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\query.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_7.2.7601.16406_none_2834f2e6cbac95ed\WmiPrvSE.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-wimgapi_31bf3856ad364e35_6.1.7601.17514_none_8b030c557320a2c1\wimserv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bubbles_31bf3856ad364e35_6.1.7601.17514_none_cca44baae0912bbe\Bubbles.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.1.7600.16385_none_4ffeefd67d89d45b\Hearts.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_6.1.7601.17514_none_28c78887678afbb1\mip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\unsecapp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Temp\PendingRenames\c0811fa15eadd601f6090000d003d40c.wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_7.2.7601.16406_none_c2d99a7d6b996caf_winmgmt.exe_8f8eb7b1 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\MigSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_6.1.7601.17514_none_eb5947ea4debcf36\RMActivate_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.1.7601.17514_none_c9f484476f1589ca\PhotoScreensaver.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\RegisterMCEApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_6.1.7600.16385_none_8fbb77bb3cd808d1\pcawrk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_6.1.7600.16385_none_3020274b22e8a90f\help.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-proquota_31bf3856ad364e35_6.1.7601.17514_none_85ecfd46a904b22a\proquota.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_6.1.7600.16385_none_d0632cbfee5db937\sc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498_axinstui.exe_eba3b15b e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\ehrec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_6.1.7600.16385_none_76e39d87a834545e\dccw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-netplwiz-exe_31bf3856ad364e35_6.1.7600.16385_none_ed2d0ae971b57e8d\Netplwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2b166002b7f51771\flyout.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\537950d9c71af966e1d8c9deb550f842\WsatConfig.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_4b57445488ba33fd\IMJPUEX.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-makecab_31bf3856ad364e35_6.1.7600.16385_none_4cc4738d82efdf85\makecab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ng-spooler-splwow64_31bf3856ad364e35_6.1.7601.17514_none_25d05769a8973724\splwow64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tasklist_31bf3856ad364e35_6.1.7600.16385_none_843823d87402ab36\tasklist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_f59e20ddece8f922\CertEnrollCtrl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\Fonts\GlobalUserInterface.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-format_31bf3856ad364e35_6.1.7600.16385_none_265f38d5eb4d284a\format.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-corewebengine_31bf3856ad364e35_6.1.7601.17514_none_2dd00d963fe4475e\iisstart.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_6.1.7600.16385_none_5a9496fc0f35b80b\DWWIN.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_7.2.7601.23317_none_8bbc62669000194c\powershell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_6.1.7600.16385_none_09320e5ae212b9d9\powercfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_6.1.7601.17514_none_6ba44fa419d13382\msoobe.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.16406_none_d12637705fe02c19\WmiApSrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wpf-presentationhostexe_31bf3856ad364e35_6.2.7601.17514_none_96490604d588c19b\PresentationHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmstp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_11.2.9600.16428_none_8eaf79351dba1b94\SetIEInstalledDate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_8.0.7601.17514_none_1e7b93842c84c912\ConfigureIEOptionalComponents.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_6.1.7600.16385_none_63df9c242588e5fc\rekeywiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_7.2.7601.16406_none_12dfd742b4fa81af\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..lified-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_763763505e93084b\IMSCPROP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mspaint_31bf3856ad364e35_6.1.7600.16385_none_ea12784c0842bfc1\mspaint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-time-tool_31bf3856ad364e35_6.1.7600.16385_none_48fe0cfd559f80ad\w32tm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_6.1.7600.16385_none_3142c61b8ada510f\ReAgentc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7601.17514_none_04d9defd57c1f6bf\mfpmp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-snmp-evntwin_31bf3856ad364e35_6.1.7600.16385_none_b6a71a3466cfbde7\evntwin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-1.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\500-19.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-compact_31bf3856ad364e35_6.1.7600.16385_none_55ea2c71cf438ffc\compact.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_934d08d31b96d4ee\msra.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.23317_none_d1a5bc75790553c0\mofcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCmdRun.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\SearchIndexer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\SearchProtocolHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sort_31bf3856ad364e35_6.1.7600.16385_none_07b314fa3333f10d\sort.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_6.1.7601.17514_none_ac02530437b71a3f\mstsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_f0686b7ca6acde00\wlrmdr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pubs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-xcopy_31bf3856ad364e35_6.1.7600.16385_none_beea9c500dfd4622\xcopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-icm-dccw_31bf3856ad364e35_6.1.7600.16385_none_813847d9dc951659\dccw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_76239aafb364e805\rasautou.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.2.9600.16428_none_8cae83b0cdeb7a9b\ielowutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_6.1.7600.16385_none_77536d124094b997\TpmInit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ehome\Mcx2Prov.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_aspnet_regsql_b03f5f7f11d50a3a_6.1.7600.16385_none_dcb42ec76404494f\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_6.1.7600.16385_none_fd9ec705e687f8c2\WMIC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-tzutil_31bf3856ad364e35_6.1.7601.17514_none_9cbe849a4e275c84\tzutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-regsvr32_31bf3856ad364e35_6.1.7600.16385_none_782d737490d72da3\regsvr32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\SystemPropertiesRemote.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_a223bd3dd785391a\dw20.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_6.1.7600.16385_none_6550a9de9a702b0f\powercfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-osk_31bf3856ad364e35_6.1.7600.16385_none_aa93298fbb4246f2\osk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\relog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-wusa_31bf3856ad364e35_6.1.7601.17514_none_af07fb6876def437\wusa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\d632b7434f821829827657e23ac98589\ComSvcConfig.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_51bcbc61a5466a58_certenrollctrl.exe_9495aa75 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_powershell-gac-tool_exe_31bf3856ad364e35_7.2.7601.23317_none_dba79eb1e1bdddda\PSCustomSetupInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..g-xpsdocumentwriter_31bf3856ad364e35_6.1.7601.17514_none_80fea45979a5d3f2\MxdwGc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\SystemPropertiesRemote.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_722b680e4b585656\winrs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_42ee5aff60183c81\iscsicli.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_6.1.7601.17514_none_78dd6e4cd6655603\WmiPrvSE.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_6.1.7600.16385_none_7b64ef799c494a30\xpsrchvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\diskperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_6.1.7600.16385_none_1cc9274696810e2f\wevtutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_6.1.7601.17514_none_5840c326cdf5dca9\manage-bde.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_6.1.7600.16385_none_9edabb9befc6e697\powershell_ise.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.1.7601.17514_none_6dd5e8c3b6b81894\PhotoScreensaver.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\mcupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_6.1.7600.16385_none_e4f094112e8f905d\wimserv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_9edcb4a706944d0a\convert.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-infdefaultinstall_31bf3856ad364e35_6.1.7600.16385_none_6c6ad9e2fd62ff6a\InfDefaultInstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_6.1.7601.17514_none_df46d976c8a5880b\InetMgr6.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\replace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\SvcIni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7601.17514_none_227e1c01642654f4\wermgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_c9392808773cd7da\cleanmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-services-ehsched_31bf3856ad364e35_6.1.7600.16385_none_0167f08155bf1c81\ehsched.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_6b683cb78f534561\mmc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_6.1.7601.17514_none_7d0125c85cc31d2a\rdpshell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wpf-presentationfontcache_31bf3856ad364e35_6.1.7601.17514_none_63bf9c3e28cd9bfb\PresentationFontCache.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a9893e83c110fe46\cpu.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Green Bubbles.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_6.1.7601.17514_none_6e88c3faa2049408\WmiPrvSE.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_6.1.7601.17514_none_d0fbe940e38daf1f\wiaacmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_44b0c76c35d4b76d\wab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\tree.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Stars.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-at_31bf3856ad364e35_6.1.7600.16385_none_a8f696109d958c5c\at.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.2.9600.16428_none_7b0d6f67c2d3f97a\iexplore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-write_31bf3856ad364e35_6.1.7600.16385_none_bb77c3d6f6c8e3f6\write.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.16406_none_db7ae1c29440ee14\mofcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.2.9600.16428_none_eab4546b9b62b250\iexpress.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_6.1.7601.17514_none_88e35d5cb2d54359\net1.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_netfx35linq-csharp_31bf3856ad364e35_6.1.7601.17514_none_193318f5726bf1d7\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c99bfc6ddd1bf1d2\slideShow.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_6.1.7600.16385_none_0c9cb55c61e99805\dcomcnfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_6d6b3cfb6a5a1e5a_ndadmin.exe_8e57269f e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\instnm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\dfsvc.ni.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_aspnet_compiler_b03f5f7f11d50a3a_6.1.7600.16385_none_ed4e6c0f14dce27e\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_cb604f1aa758e6b6\IMJPDSVR.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..erinboxgames-spades_31bf3856ad364e35_6.1.7600.16385_none_6fa6d7361acba514\shvlzm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_6.1.7600.16385_none_8d6c9c807200865a\TSWbPrxy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496_wowreg32.exe_94fc2d06 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_347a450f0c8bd52d_printui.exe_bb673fff e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_7.2.7601.23317_none_85f001bc79c38693\Register-CimProvider.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\setup16.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_8.0.7600.16385_none_23079f05995ee912\SetIEInstalledDate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_e292664733bd5af6\ie4uinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_6.1.7600.16385_none_82523ed4cbbd035a\etfsboot.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Orange Circles.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_6.1.7600.16385_none_964da911ba806d45\colorcpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_6.1.7600.16385_none_498d334c14a3b9bb\hwrreg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_7f0c7a3c17077fce\iexpress.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mspaint_31bf3856ad364e35_6.1.7600.16385_none_8df3dcc84fe54e8b\mspaint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-recover_31bf3856ad364e35_6.1.7600.16385_none_85e9a3f215ee94e3\recover.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_c1bcb003ee041301\chkdsk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_6.1.7600.16385_none_0d4d30a05370cb73\odbcconf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-tasklist_31bf3856ad364e35_6.1.7600.16385_none_28198854bba53a00\tasklist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_160ccc8a92fae520\winrs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Hand Prints.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.1.7601.17514_none_0a026c46104dd379\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrmUi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_6.1.7600.16385_none_45fe6fe8a9201e55\comrepl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.2.9600.16428_none_46d2efef53c02386\wextract.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-wizard_31bf3856ad364e35_6.1.7600.16385_none_7680aa7b6195f2c6\DVDMaker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_6.1.7601.17514_none_a2fcd94e8fba36f5\RMActivate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..platform-input-core_31bf3856ad364e35_6.1.7601.17514_none_2f3651e7f36d703f\wisptis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_63dee2821fc69fce_bridgeunattend.exe_60b7e340 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8a5c3d2bac37e9\ntkrnlpa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\poqexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-sstext3d_31bf3856ad364e35_6.1.7601.17514_none_06402269bdde4ced\ssText3d.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-19.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104\sdbinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_6.1.7600.16385_none_e3aea9874278550c\cofire.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-mcx2prov_31bf3856ad364e35_6.1.7600.16385_none_3482237b32c1daff\Mcx2Prov.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_3eb101caec1acc2c\ie4uinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_6.1.7601.17514_none_cb4d60191a09a7b0\PresentationSettings.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-magnify_31bf3856ad364e35_6.1.7600.16385_none_ca22c913b260e66a\Magnify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\appcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_msbuild_b03f5f7f11d50a3a_6.1.7601.17514_none_558f74866ddb8017\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_wpf-globalserifcf_31bf3856ad364e35_6.1.7600.16385_none_8f6eab2bb993c745\GlobalSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_58116b392c3da43c\takeown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-verclsid_31bf3856ad364e35_6.1.7600.16385_none_17dbc2dd2d2552c7\verclsid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-magnify_31bf3856ad364e35_6.1.7600.16385_none_6e042d8ffa037534\Magnify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_6.1.7600.16385_none_a749cec7a8b6bf08\wbadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_6.1.7600.16385_none_9cef76e6ecab612f\SystemPropertiesHardware.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_7.2.7601.16406_none_b884f02b3738aab4\WinMgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_8.0.7600.16385_none_2106a98149904819\ielowutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\find.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\print.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\finger.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-xwizard-host-process_31bf3856ad364e35_6.1.7600.16385_none_58ca66f699d77ff1\xwizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\main.html e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-alg_31bf3856ad364e35_6.1.7600.16385_none_04de43c774cf8fe3\alg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647_appidcertstorecheck.exe_03352f5f e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_7.2.7601.23317_none_dbfa66c7ad6615bb\WMIADAP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_87f259ebb3f177fa\ConfigureIEOptionalComponents.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_8.0.7601.17514_none_055d8a4166e66f09\ieinstal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_5da98f433f7e2878\where.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Roses.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\config.json e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_6.1.7601.17514_none_b5ac5cc3a1b7e9ef\BitLockerWizardElev.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\msil_jsc_b03f5f7f11d50a3a_6.1.7600.16385_none_7c5b469993c3ad32\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\HOSTNAME.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\500-14.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.2.9600.16428_none_f937400aa65f97cc\iediagcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_6.1.7601.17514_none_b5ac5cc3a1b7e9ef\BitLockerWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Shades of Blue.htm e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\attrib.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..ng-spooler-splwow64_31bf3856ad364e35_6.1.7601.17514_none_25d05769a8973724_splwow64.exe_74753166 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_44aa873ff9136c27\RegisterIEPKEYs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 292 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe Token: 33 292 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe Token: SeIncBasePriorityPrivilege 292 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe Token: SeIncBasePriorityPrivilege 1984 svchost.exe Token: SeLockMemoryPrivilege 1984 svchost.exe Token: SeLockMemoryPrivilege 1984 svchost.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 292 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 292 wrote to memory of 1984 292 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe 26 PID 292 wrote to memory of 1984 292 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe 26 PID 292 wrote to memory of 1984 292 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe 26 PID 292 wrote to memory of 1984 292 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe 26 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe"C:\Users\Admin\AppData\Local\Temp\e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:292 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1984
-