Analysis
- max time kernel
150s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:28
Static task
static1
Behavioral task
behavioral1
Sample
e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe
- Size 8.9MB
- Sample201109-n18wekdkma
- SHA256 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1
- MD5 ae086d0d666c0baa7c2018227c213023
- SHA1 7473bb65f0e44277f87c910573bc8170279ed671
- SHA512 8a05ef37400c4a89e85fdc08d58c8321d553cc92c2cd1ff8877061ed96b9beece6253f609204bff5ad9ce5615a25eb0610d6682a1e24b92acaef1782b1493c55
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3592 svchost.exe - Sets file execution options in registry 2 TTPs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe" e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000200000001ab5c-1.dat js - Drops file in System32 directory 343 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\eventvwr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\logman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rekeywiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\setx.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sdiagnhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\shrpubw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\F12\F12Chooser.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cleanmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\prevhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Taskmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TRACERT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\winrs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\AtBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\bcastdvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rrinstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\setupugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\quickassist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\poqexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\psr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rasphone.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\replace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\at.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\autoconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dtdump.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\label.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\subst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WerFault.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ndadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\newdev.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\syskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\unlodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wermgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\chkntfs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\NETSTAT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\pcaui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Magnify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mmc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\UIMgrBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\waitfor.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Com\comrepl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\charmap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mspaint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\notepad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\DpiScaling.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ipconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\xwizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\user.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\write.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\diskraid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\finger.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\MuiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\raserver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\tdlrecover.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\verifiergui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\netsh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\odbcconf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PkgMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\schtasks.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\autochk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Dism.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\find.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\hh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\where.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\typeperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\xcopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\icsunattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mobsync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\OpenWith.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cipher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cliconfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fontdrvhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wlanext.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dplaysvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dvdplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fltMC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\setup16.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TSTheme.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\lodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\MRINFO.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\osk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SecEdit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\makecab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RMActivate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\certutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dialer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\eudcedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\iexpress.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SearchIndexer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\scrnsave.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PresentationHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Utilman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\winrshost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cmdkey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dccw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\msdt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\systeminfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\compact.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cttune.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\OposHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\attrib.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fsquirt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\bthudtask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\whoami.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\getmac.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rasdial.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ROUTE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dpapimig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\gpscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\InstallAgentUserBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\shutdown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TpmInit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\comp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\eventcreate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\netbtugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\resmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\runas.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\w32tm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\gpresult.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ntprint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\DWWIN.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\tzutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wiaacmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\clip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\hdwwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ieUnatt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mavinject.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\odbcad32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\regini.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rundll32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\autofmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dcomcnfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\expand.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mstsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sdbinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\vssadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\gpupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mshta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sort.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TapiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dllhst3g.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\findstr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dpnsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mfpmp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RdpSa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\tracerpt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\edpnotify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\LaunchTM.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mountvol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\openfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ReAgentc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mode.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\colorcpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\InstallAgent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mtstocom.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\tree.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\tcmsetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WWAHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\certreq.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fontview.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\perfhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mcbuilder.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wextract.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\esentutl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sfc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\chcp.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cmmon32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\isoburn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\regsvr32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PATHPING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\rasautou.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Robocopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\taskkill.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wscadminui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\extrac32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ftp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\proquota.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\reg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\svchost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\format.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\more.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\bootcfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\CloudStorageWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\mmgaserver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\powercfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\bitsadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\nslookup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\secinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Macromed\Flash\FlashUtil_ActiveX.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\msra.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RpcPing.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SndVol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SyncHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\choice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\CloudNotifications.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dxdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\help.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\verclsid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sethc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wusa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ddodiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\diskpart.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Fondue.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\iscsicpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\logagent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\net.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\xpsrchvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\winver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\auditpol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\efsui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\printui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\regedt32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wsmprovhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\netiougc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\relog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\chkdsk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\driverquery.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\msiexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wevtutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\regedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\doskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\GamePanel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\Netplwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sxstrace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fixmapi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\timeout.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\systray.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\diskperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\net1.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\runonce.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\userinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cmdl32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dllhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\recover.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\sdchange.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PickerHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\srdelayed.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\tasklist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ARP.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\explorer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\fsutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\iscsicli.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\instnm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\print.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\appidtel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cmstp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\SysWOW64\FlashPlayerApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\icacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\forfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wowreg32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ktmutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\upnpcont.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\control.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\cttunesvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\msfeedssync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\takeown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\unregmp2.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\calc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\dfrgui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\grpconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\RmClient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\perfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\PING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\convert.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\credwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\ctfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SysWOW64\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - Drops file in Program Files directory 348 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Mail\wabmig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\setup_wm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Google\Temp\GUMED0D.tmp\GoogleUpdateSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Internet Explorer\ielowutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\microsoft shared\ink\FlickLearningWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Internet Explorer\ieinstal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender\MpUXSrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\pipanel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender\MSASCuiL.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender\MsMpEng.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender\NisSrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender\MSASCui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\86.0.4240.111_chrome_installer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Mail\WinMail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmpshare.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_2BD8F.tmp\setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Mail\wab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\7-Zip\7z.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmplayer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmprph.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Mail\WinMail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows Mail\wab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Internet Explorer\iexplore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files\Internet Explorer\ExtExport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - Drops file in Windows directory 1737 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.15063.0_none_5ed4a96b3e219375\RelPost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.15063.0_none_b1c695092fbfd7f6_winmgmt.exe_8f8eb7b1 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.15063.0_none_6842e50103173914\label.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.15063.0_none_6fe178eabc5e329f\TFTP.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_32122b5ce7c5dcad\print.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.15063.0_none_79729325b214f08b\vssadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Fonts\GlobalSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.15063.0_none_8fd6bea441dc2df3\sc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.15063.0_none_48fd4ce64b0e7573\CHXSmartScreen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.15063.0_none_79ec3e93cebba02c\diskpart.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.15063.0_none_dc3212611c2a948b\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\CortanaListenUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.15063.0_none_2cf79951e4b1c881\TabTip32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.15063.0_none_ca5918b733df3b74\CheckNetIsolation.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.15063.0_none_7b1daf1c87eb47d6\SndVol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msdt_31bf3856ad364e35_10.0.15063.0_none_b6963b2c565532e6\msdt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\ActionUriServer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.15063.0_none_6cd577f4d7a0eae0\slui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.15063.0_none_524878e9ff5a92d0\klist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.15063.0_none_2f3d10ebdb615e96\DpiScaling.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.15063.0_none_b875261d4456ac92\dpnsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_c2dd647ead0a6f20\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.15063.0_none_fa9810fda15c2391\DataExchangeHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_43dacce387acdc1b\ARP.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.15063.0_none_55f8428e68e5e677\dispdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5563c0977685c595\odbcad32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.15063.0_none_2b39bde895602e9a\sdiagnhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sethc_31bf3856ad364e35_10.0.15063.0_none_17b57caef58c9683\sethc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.15063.0_none_f0874b6193bffceb\tabcal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.15063.0_none_c8d89c49f24559e2\wmpnscfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-mapi_31bf3856ad364e35_10.0.15063.0_none_60427f049a30f757\fixmapi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.15063.0_none_24b3fd43e48317bc\RMActivate_ssp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-wsatconfig_b03f5f7f11d50a3a_4.0.15552.17062_none_78b9226616885377\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.15063.0_none_2b428241d2829ac6\rasautou.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-diskpart_31bf3856ad364e35_10.0.15063.0_none_1dcda310165e2ef6\diskpart.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\config.json e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-wab-app_31bf3856ad364e35_10.0.15063.0_none_f79e9b365803e694\wab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttune_31bf3856ad364e35_10.0.15063.0_none_c49865aaf753d1b3\cttune.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.15063.0_none_70fc227d963c1c0f\runas.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systray_31bf3856ad364e35_10.0.15063.0_none_0465560c2ed8ccc5\systray.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.15063.0_none_8c5b63ddd64a47e4\backgroundTaskHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_10.0.15063.0_none_feac1ade33c16c7c\hwrcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.15063.0_none_39570b6a93205df7\tasklist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_14438aa05ed06a1a\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.15063.0_none_6b7bc361308b8a86\WMSvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_409d39d091c700e8\ngentask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.15063.0_none_a2267c9af28bf1ee\IMJPDCT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wcf-servicemodelreg_b03f5f7f11d50a3a_10.0.15063.0_none_25f0a4bdfb1087e3\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_10.0.15063.0_none_47629fc60bf6cba0\baaupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.15063.0_none_e53f0edd42065bd0\help.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.15063.0_none_acda54383114f33b\WindowsActionDialog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.15063.0_none_745d774324c4ca33\Register-CimProvider.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.15063.0_none_e6e8f77bd3a209e8\nslookup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.15063.0_none_855bae4f08598144\TapiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-globalserifcf_b03f5f7f11d50a3a_4.0.14917.0_none_f940072d9ed26ef9\GlobalSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vaultcmd_31bf3856ad364e35_10.0.15063.0_none_f79589e192cbbae3\VaultCmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.15063.0_none_ddaf2db073e6652b\dstokenclean.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.15063.0_none_2da12d30354af4c0\ieinstal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.14917.0_none_c4d0bd5ffc35411b\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.15063.0_none_7ed8a758a50ab894\SystemPropertiesDataExecutionPrevention.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..client-installagent_31bf3856ad364e35_10.0.15063.0_none_053a926c712c32b7\InstallAgentUserBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ldifde_31bf3856ad364e35_10.0.15063.0_none_d5dc7e798943c3ec\ldifde.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_be549efe47bbc296\TiWorker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_10.0.15063.0_none_8815846f65bab26d\drvinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.15063.0_none_3e647a9c9c7f6cb1\MigRegDB.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-desktopview.appxmain_31bf3856ad364e35_10.0.15063.0_none_853ad4a82fdd02e5\DesktopView.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-machine_config_b03f5f7f11d50a3a_4.0.14917.0_none_9ccc0f687334fcca\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.15063.0_none_f5efc2f5536ba2ba\SystemPropertiesHardware.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.15063.0_none_b9389646c80384de\SenseCncProxy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.15063.0_none_4107792cae6166b7\raserver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.15063.0_none_aad7db68c271ad4a\SnippingTool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.14917.0_none_78b2cb1005320800\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.15063.0_none_ccfaaa6f4c430588\verclsid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.15063.0_none_262f2cb987063af6\xpsrchvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_ede638855a798c86\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_ca4f5e6b58aecca9\LaunchTM.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.15063.0_none_0726d88040adbf08\instnm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.15063.0_none_f0842d2a2e65b30a\NETFXSBS10.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.15063.0_none_8b6fa02da9f8cc9c\WerFault.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.15063.0_none_3952819293249261\taskhostw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.15063.0_none_52c09ab76f1549aa\sdchange.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\LaunchTM.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.15063.0_none_ddbbb06b516e5f13\iexplore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_datasvcutil_b77a5c561934e089_10.0.15063.0_none_82ca18f5dce51b6e\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.15063.0_none_186aaeb041dece84\RdpSaProxy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.15063.0_none_9874e9a3703899ed\hcsdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.15063.0_none_a98130f2e25a891f\iexpress.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.15063.0_none_663748d9165783b2\forfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_ca4f5e6b58aecca9\Taskmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.15063.0_none_b4c6506de36acc0b\TokenBrokerCookies.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.15063.0_none_6944d1208e470b61\mstsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.15063.0_none_0064b2c78d23d765\mobsync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.15063.0_none_ed3c934f0a7eb173\userinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_cc7c7b2f51c14573\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-globalmonospacecf_b03f5f7f11d50a3a_4.0.14917.0_none_210cf0f4c0b42c8d\GlobalMonospace.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.15063.0_none_b209489c6a46d752\RMActivate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15552.17062_none_9fc59f9d02365cc9\Microsoft.Workflow.Compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.15063.0_none_e75f7c5afa577e7e\spoolsv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.15063.0_none_f83a403a2332e36b\openfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-whoami_31bf3856ad364e35_10.0.15063.0_none_8371bc0c024770f3\whoami.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.15063.0_none_185b44f7e35503fd\LockScreenContentServer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.15063.0_none_d88fa8f4ff243384\Defrag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-miracastview.appxmain_31bf3856ad364e35_10.0.15063.0_none_3d8834d7dbd2a689\MiracastView.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.15063.0_none_9758d85423af97b8\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.15063.0_none_74894a33fa3c3fba\RdpSaProxy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.15063.0_none_61248a6e73dcd239\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.15063.0_none_2512848dd7232cc6\cliconfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.15063.0_none_460932e9ff0c93bd_wowreg32.exe_94fc2d06 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.15063.0_none_fe76b282068b2ad7\msiexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.15063.0_none_fc546570fad79187\logagent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.14917.0_none_e5bb394894ccdca5\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.15063.0_none_8e812ab345b2695f\esentutl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.15063.0_none_0fb37e8e2e536acc\DWWIN.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.15063.0_none_091c59b88ed6fbeb\unlodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.15063.0_none_38dad110cb33e151\proquota.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.15063.0_none_bdff37299158b71e\ftp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.15063.0_none_fe45181eaae96324\IMJPUEX.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.15063.0_none_8b5bac6f93becfcc\DpiScaling.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.15063.0_none_bf07a2bb0f599355\setup_wm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.15063.0_none_97272707ed69b8da\recover.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.15063.0_none_cdc1fcf8bea2c765\mountvol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-choice_31bf3856ad364e35_10.0.15063.0_none_785c28c20c34345d\choice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.15063.0_none_ef5cc4b45c85e034\ielowutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.15063.0_none_0de94e88b8f532b2\xwizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.15063.0_none_c17d729c441d6e56\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.14917.0_none_afa3e34fe8e69502\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.15063.0_none_f1bcc32b631bc64f\printui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.15063.0_none_b5b964a5d38cb983\repadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-time-tool_31bf3856ad364e35_10.0.15063.0_none_a1fe590bbc5fc238\w32tm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.15063.0_none_62773c5c2940e6fe\umount.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_4.0.15552.17062_none_fad4b804fcdf35c4\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\holoitemplayerapp_cw5n1h2txyewy\HoloItemPlayerApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-driververifier_31bf3856ad364e35_10.0.15063.0_none_6f6118cd1d2cae7c\verifiergui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.15063.0_none_e08e1b062a8d984d\DmOmaCpMo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.15063.0_none_8fe2a8c1a908d138\EASPolicyManagerBrokerHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-writewin_31bf3856ad364e35_10.0.15063.0_none_eca71e55290beacf\write.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.15063.0_none_8081c377425d8edd\fsquirt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.15063.0_none_26d246aabc4934f8\wmplayer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.15063.0_none_ca67dc4e5867595b\WMIADAP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_1618b8867f46668a\typeperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.15063.0_none_9f294bcd2d20deda\CompMgmtLauncher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.15063.0_none_f353ae3cc9415a87\iscsicpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..oplearning.appxmain_31bf3856ad364e35_10.0.15063.0_none_6d2f98bc0f17cbd5\DesktopLearningApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_8e30c6e0a0234de3\mode.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_7237540a37a3d7c0\tracerpt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.15063.0_none_283f88434cf89234\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.15063.0_none_62e9073756fc221f\setup_wm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.15063.0_none_a76741ebe0e3bb6f\RuntimeBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.15063.0_none_368c3243143243b4\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.15063.0_none_3b3a3cd06b522682\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_1538e2f3e84b742b\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_bae6f1b1935516b4\fontdrvhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.15063.0_none_a4f8b7f1fddd7ed6\ntprint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.14917.0_none_9a02afcc15575372\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.15063.0_none_2c51f6502201d2af\aspnetca.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.15063.0_none_319ef9f29ed6cb12\winrshost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.15063.0_none_685fe984eaf6056e\appidcertstorecheck.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.15063.0_none_3a6d7e9f5f417d20\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..client-installagent_31bf3856ad364e35_10.0.15063.0_none_fae5e81a3ccb70bc\InstallAgentUserBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.15063.0_none_b0e95dabd43a49b1\wuapihost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepadwin_31bf3856ad364e35_10.0.15063.0_none_53dda61833dbc731\notepad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_43dacce387acdc1b\NETSTAT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.15063.0_none_d4bc86a08cc81b56\mofcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.15063.0_none_72996f15c8286420_netiougc.exe_94123cfe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.15063.0_none_4df84a633c3a41c0\WWAHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.15063.0_none_ade923f4e120ed67\convert.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_43dacce387acdc1b\TCPSVCS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.15063.0_none_be2a5893dde75ca3\cipher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.15063.0_none_ec3d73d83cb41d16\extrac32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.15063.0_none_0d07ce77359b6878\SecureAssessmentBrowser.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.15063.0_none_c5c1f5efcbd6de1e\rpcinfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.15063.0_none_2feef9927ef24c51\rdpinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.15063.0_none_d74e85c5174ebf4e\Windows.Media.BackgroundPlayback.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.15063.0_none_e0340af26bb779f7\sfc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.15063.0_none_80d6da500dc0355d_winlogon.exe_ac37d0c5 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.15063.0_none_d12d9b8e26686bfa\MuiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.15063.0_none_22a2eeffb0510686\TabTip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-addinprocess_b03f5f7f11d50a3a_4.0.14917.0_none_e42e48e8672db85f\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.15063.0_none_b0ee89e4a4a3d7f0\credwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-at_31bf3856ad364e35_10.0.15063.0_none_01f6e21f0455cde7\at.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.15063.0_none_b230059daa1d4251\WmsSessionAgent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.15063.0_none_a14a05a282ed07da\vmconnect.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_8e30c6e0a0234de3\chcp.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.15063.0_none_eb768e6adc6f24b0\BitLockerDeviceEncryption.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.15063.0_none_7096ab6915e696b7\write.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-session0viewer_31bf3856ad364e35_10.0.15063.0_none_f2fac13b7f7cb7da\UI0Detect.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.15063.0_none_0dc240ea118aa24b\charmap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.15063.0_none_010eb07d5726ee72\cttunesvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.15063.0_none_d648de4f3e7db56f\DFDWiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.15063.0_none_7014b59eabaac737\MdmDiagnosticsTool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.15063.0_none_d1e80ed8b59ec0f0\wevtutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.15063.0_none_42a80d36637e324d\reg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Fonts\GlobalUserInterface.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_10.0.15063.0_none_98cd9119619607cd\cofire.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-globaluserinterfacecf_b03f5f7f11d50a3a_4.0.15552.17081_none_ac9f43eb3938858b\GlobalUserInterface.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-runonce_31bf3856ad364e35_10.0.15063.0_none_cab012523f793a32\runonce.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_4.0.15552.17062_none_7519872cb1434a01\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.15063.0_none_8a831106dd2f36d6\notepad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.15063.0_none_88895237dfe360fd\OpenWith.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-label_31bf3856ad364e35_10.0.15063.0_none_0c24497d4ab9c7de\label.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.15063.0_none_bffb0753ea8d470c\SecEdit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\tscon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-dw_b03f5f7f11d50a3a_10.0.15063.0_none_86ed0112b79e5e21\dw20.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.15063.0_none_c5c1f5efcbd6de1e\showmount.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-edmgen_b03f5f7f11d50a3a_4.0.14917.0_none_0b581cced10a2fc0\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.15063.0_none_0ab95d19c1849960\mobsync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.15063.0_none_18fe83b644a698bd\rekeywiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_1f96e1d8fd15555d\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.15063.0_none_9804404afddef197\AppHostRegistrationVerifier.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.15063.0_none_2c51f6502201d2af\appcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.15063.0_none_318a8b4f3eb2f551\wermgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.15063.0_none_dd1a011e7e3f4b06\DeviceCredentialDeployment.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.15063.0_none_7467541abda71808\ieUnatt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.15063.0_none_1a6f9170b98dddd0\powercfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.15063.0_none_bec1449b872a26f6\PickerHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wpf-globalserifcf_31bf3856ad364e35_10.0.15063.0_none_448d92bdd8b17a06\GlobalSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.15063.0_none_f61fd86d577fbde6\ChsIME.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.15063.0_none_505ddd3c336d55b8_wowreg32.exe_94fc2d06 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.15063.0_none_f05e3cb55c6587b3\gpupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_servicemodelreg_b03f5f7f11d50a3a_10.0.15063.0_none_041d4efe986b9f51\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.15063.0_none_d9950989c992f5c0\ImagingDevices.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.15063.0_none_c1bb9cee81074ac6\dcomcnfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.15063.0_none_69f7bd111ce467b4\csrss.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.14917.0_none_c046294d211b3565\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.14917.0_none_7d238688e7b91815\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.15063.0_none_4557ae123bf5c9b0\tzutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.15063.0_none_4153431b7e6a9b04\msfeedssync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.15063.0_none_6aac5ddef84ce0a1\eudcedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-defender-management-v1_31bf3856ad364e35_10.0.15063.0_none_2bb96baf4118580a\ConfigSecurityPolicy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.15063.0_none_67a2748b851e1db4\ipconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.15063.0_none_e5687006bcaf4630\SystemPropertiesComputerName.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.15063.0_none_cba14f155528f0fd\UserAccountBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.15063.0_none_35430077abed5855\dmcfghost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_4.0.14917.0_none_ef331a30efc75f15\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.15063.0_none_178a7ae4fc18241d\ComputerDefaults.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.15063.0_none_f48e6dd94fe4b408\dsdbutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.15063.0_none_d2592ae44619d217\DeviceEnroller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.15063.0_none_73d41832adea07b9\EaseOfAccessDialog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_vmconnect6.2_31bf3856ad364e35_10.0.15063.0_none_b76db9d8553591de\vmconnect6.2.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.15063.0_none_c2c00e8330a5adbb\PresentationFontCache.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.15063.0_none_278c16655bcb2420\sihost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.15063.0_none_20872449ae70f822\mmc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.15063.0_none_7578c508c1278b6b\MusNotification.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-holoshell.appxmain_31bf3856ad364e35_10.0.15063.0_none_34ae4307b90cabc4\HoloShellApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_3.5.15063.0_none_806ce54f36ffda1c\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.15063.0_none_6c3a936ba57599b0_winresume.exe_85cd1215 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-openfiles_31bf3856ad364e35_10.0.15063.0_none_9c1ba4b66ad57235\openfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.15063.0_none_5f465bd4c3d3daff\FileHistory.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.15063.0_none_847e823f6f621ee7\powershell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.0_none_c744ea6266ddc49b\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.15063.0_none_4c7cd83914c2f8e9\gpresult.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.15063.0_none_5352ed23f360146f\OOBENetworkCaptivePortal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.15063.0_none_687a148d799b8761\bitsadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_88acb9eccabb4c96\cleanmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.15063.0_none_9be63ee70131f3aa\wpnpinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.15063.0_none_8b260af8e381f328\UIMgrBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setx_31bf3856ad364e35_10.0.15063.0_none_c7df595a863fde51\setx.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.15063.0_none_62e9073756fc221f\unregmp2.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15552.17062_none_f97b8faf903ca483\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\explorer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_8e30c6e0a0234de3\find.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.15063.0_none_f2f65616bb281cd3\dnscacheugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.15063.0_none_aac266c5d4de38a1\MDMAppInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-comsvcconfig_b03f5f7f11d50a3a_4.0.15552.17062_none_8d07c33d6d0364bf\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.15063.0_none_9c209ff6532b42d7\cmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.15063.0_none_0f9738f0490821fa\regedt32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.15063.0_none_d946b84784de0b85\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.15063.0_none_6962fde13e0a86b3\cacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..spaces-creator-tool_31bf3856ad364e35_10.0.15063.0_none_806743e6508512ad\pwcreator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.15063.0_none_88b780059d6de6e9\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_b77241b70e236b73\perfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_be549efe47bbc296\TiFileFetcher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rdrservicesupdater.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.15063.0_none_91639b109d0e15dd\DiskSnapshot.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\chglogon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_datasvcutil_b77a5c561934e089_4.0.14917.0_none_bb7e077496348fa3\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_eventviewersettings_31bf3856ad364e35_10.0.15063.0_none_10605b9270e29f65\eventvwr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.15063.0_none_5537c7ef2c50bade\dllhst3g.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.15063.0_none_90f705c45bf8534d\SettingSyncHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.15063.0_none_228a248d8977d11b\newdev.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.15063.0_none_05428e9e14a75fff\regedt32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_cortanalistenuiapp.appxmain_31bf3856ad364e35_10.0.15063.0_none_a77691fc46bff4dd\CortanaListenUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.15063.0_none_5a2f0b5a38dbd3eb\dsacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_4.0.14917.0_none_273f63add301dc34\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-makecab_31bf3856ad364e35_10.0.15063.0_none_a5c4bf9be9b02110\makecab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-regini_31bf3856ad364e35_10.0.15063.0_none_c14b7a243a422bb0\regini.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_4e2f7735bc0d9e16\NETSTAT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.15063.0_none_aa5fd013d8a1f5c4\SearchIndexer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.15063.0_none_96a2ab2c43fe3040\WindowsUpdateElevatedInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.15063.0_none_9b4bb01690591548\SettingSyncHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.15063.0_none_aecde74979873d40\RpcPing.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.15063.0_none_fa65b73828786f93\RMActivate_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-defender-ui_31bf3856ad364e35_10.0.15063.0_none_271cf75b18cc3161\MSASCui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.15063.0_none_fb45d9ed359a5804\SystemSettingsBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.15063.0_none_50af37c8f560d163\bash.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.15063.0_none_7e3b33e33c38d6d7\PresentationSettings.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.14917.0_none_6a62d030b3efb452\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-format_31bf3856ad364e35_10.0.15063.0_none_379cbbebc2c84c41\format.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\hh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.15063.0_none_53f9a32e0ee49958\powershell_ise.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.15063.0_none_fe6a8dff4930a284\Netplwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.15063.0_none_72996f15c8286420\netiougc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_4.0.15552.17062_none_266065093dc9abd3\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.15063.0_none_0dbf7ea91dc966a4\Microsoft.Uev.SyncController.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.0_none_9f315fde27607282\mspaint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.15063.0_none_c343d159b5adad58\IMJPSET.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ionsimulationdevice_31bf3856ad364e35_10.0.15063.0_none_8c91bbc89bdb0560\PerceptionSimulationDevice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.15063.0_none_2d22a7eec0f49815\WmsManager.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_4.0.15552.17062_none_b11829c6585f0f33\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\svchost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.15063.0_none_993ed5feddfa59b3\bcdedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rascmak_31bf3856ad364e35_10.0.15063.0_none_2bf4e41ce5e45a59\rqc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.15063.0_none_8a431229f19a929a\ReAgentc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-defender-ui_31bf3856ad364e35_10.0.15063.0_none_271cf75b18cc3161\MSASCuiL.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.15063.0_none_e6c4eeedef70115b\EDPCleanup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.15063.0_none_5206261f1378192b\desktopimgdownldr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_10.0.15063.0_none_80cd4dc1343c6644\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.15063.0_none_c6209afdaf9f22bc\fhmanagew.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.15063.0_none_02b0909f8d37f8f3\bdechangepin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.15063.0_none_aa5fd013d8a1f5c4\SearchProtocolHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.15063.0_none_d18291ac7ced838a\ieinstal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.15063.0_none_c6dcc9c4744586b9\omadmprc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.15063.0_none_703418aa99544657\cmstp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.15063.0_none_8206b98ba1e985e9\backgroundTaskHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.15063.0_none_b7a58a094557495d\PnPUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.15063.0_none_f5ad4336b7886518_lsaiso.exe_51c00eb7 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.15063.0_none_91dcb07a5d494b7f\cmdkey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\svchost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.14917.0_none_95ef0c98089085f7\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\WFS.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.15063.0_none_be3772f6b91825d9\FXSUNATD.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.15063.0_none_76a6ebc7ac07641a\LogonUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.15063.0_none_361d95859f974d34\sdclt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_10.0.15063.0_none_25273e3a8c447964\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.15063.0_none_7a29d7ed3b015cec\powershell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_e9d295514db2bf0b\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.15063.0_none_597c2c4f3928aae3\wscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timezone-sync_31bf3856ad364e35_10.0.15063.0_none_a044c91d59238e57\tzsync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.15063.0_none_e90f431abc6e1fcb\wbemtest.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\ContactSupport_cw5n1h2txyewy\ContactSupport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\SecondaryTileExperience.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.15063.0_none_af6b1cb112ce3d3c\UpgradeResultsUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_10.0.15063.0_none_8890f028180fdd8e\TpmInit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.15063.0_none_ae2569c52e124f5a\WUDFHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.15063.0_none_af6b1cb112ce3d3c\changepk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_8e30c6e0a0234de3\print.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.15063.0_none_2feef9927ef24c51\rdpshell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.15063.0_none_8f74af7c219a26c7_smss.exe_d7209c3a e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.15063.0_none_fd5c70d52ef09e52\autochk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.15063.0_none_8081c377425d8edd\bthudtask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.15063.0_none_4cfcb78897def448\reg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.15063.0_none_117a2cfd2ed7a2ee\BioEnrollmentHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.15063.0_none_64b3af92ba4e8a1f\omadmclient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.14917.0_none_ecb9b1174ca4c7d4\ngentask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_1618b8867f46668a\logman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.15063.0_none_9d381ab4e6c94aac\easinvoker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.15063.0_none_8eb8038c63052a18\AgentService.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.15063.0_none_1a46de6983dae7b8\lpkinstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_4.0.14917.0_none_d42fd5573bb36a55\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-diskraid_31bf3856ad364e35_10.0.15063.0_none_1a7ee1c6186b79d5\diskraid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-configurationclient_31bf3856ad364e35_10.0.15063.0_none_c5b9e8beb23d1801\acu.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_multipoint-logcollector_31bf3856ad364e35_10.0.15063.0_none_b13658d5d3f0f7bc\LogCollector.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.15063.0_none_a5a7fb1f2285d5e3\schtasks.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.15063.0_none_062aa8c2373d99ad\RMActivate_ssp_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.15063.0_none_bd6123811a52b7a2\PasswordOnWakeSettingFlyout.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.14917.0_none_a59806f64b1a6b6f\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.15063.0_none_62773c5c2940e6fe\mount.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.15063.0_none_d81b08ba2532f621\Robocopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.15063.0_none_703418aa99544657\cmdl32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_43dacce387acdc1b\finger.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-defender-modern-app_31bf3856ad364e35_10.0.15063.0_none_f1fa9ddff55e67bc\MpUXSrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.15063.0_none_a24476fcc1c2a5b1\net1.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15552.17062_none_e06627396c597a63\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.15063.0_none_8136139ab73880ae\NetCfgNotifyObjectHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.14917.0_none_8acfa578e42b49b9\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.15063.0_none_2e562fe1fa843a72\rrinstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-extrac32_31bf3856ad364e35_10.0.15063.0_none_901ed8548456abe0\extrac32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..pickerhost.appxmain_31bf3856ad364e35_10.0.15063.0_none_1eafad097b3c26e6\ModalSharePickerHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.15063.0_none_c5177aba769d526d\lpr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.14917.0_none_b2100707c86bdd58\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.15063.0_none_9223897625b59d49\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.15063.0_none_8cf973e8c6901821\Spectrum.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.15063.0_none_83cb17c9a9e3777c\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.15063.0_none_e245df18e421fb7b\MigRegDB.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-newdev_31bf3856ad364e35_10.0.15063.0_none_c66b8909d11a5fe5\newdev.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.15063.0_none_bcd1fc8c5251a3ce\sort.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.15063.0_none_357318c4046e3d36\TsWpfWrp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.15063.0_none_63d0d6a16d896cde\wscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.15063.0_none_0788a13bc0653569\efsui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.15063.0_none_8f74af7c219a26c7\smss.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.15063.0_none_dc62da3fc66fefa8\FirstLogonAnim.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.15063.0_none_b481f63064666ea7\WpcUapApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.15063.0_none_fc2457edb4cdc66c\SysResetErr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.15063.0_none_aa5fd013d8a1f5c4\SearchFilterHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.15063.0_none_20edd7ef9e21d8cb_rasautou.exe_477abe34 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.15063.0_none_2bcb4216f894852a\WmiPrvSE.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.15063.0_none_f883ebc20cc094ca\LockApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.15063.0_none_b4b47a660d02b7bf\SearchIndexer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.15063.0_none_8920735989a8ea9a\help.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.15063.0_none_476a6b4bd5bd6612\ddodiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.15063.0_none_4654677f989761d9\vmwp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.15063.0_none_f8d011cfcd72e369\securekernel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.14917.0_none_13608ff6cc6f454f\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.15063.0_none_92ce01ad7e234d32\PrintBrmEngine.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.15063.0_none_96267e4211f788b3\PrintDialog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.15063.0_none_fe45181eaae96324\IMJPDCT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.14917.0_none_09029111b7a5641d\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-remoteposworker_31bf3856ad364e35_10.0.15063.0_none_30938ecfaf989ba7\RemotePosWorker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.15063.0_none_7bcd4bed6473a2c8\netbtugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-globaluserinterfacecf_b03f5f7f11d50a3a_4.0.14917.0_none_58bbeaa7f416165c\GlobalUserInterface.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.15063.0_none_b1926b4e2e2a5966\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.15063.0_none_ce7f342a6c769cf7\ofdeploy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-cttune_31bf3856ad364e35_10.0.15063.0_none_6879ca273ef6607d\cttune.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.15063.0_none_cf01d9f135499d1a\mcbuilder.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.15063.0_none_35b3a50d81f066f6\ImagingDevices.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.15063.0_none_1e8ab3b62aebef6a\odbcconf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.15063.0_none_c08b9f459d3ad9c2\TieringEngineService.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_2b31e6a8759b2d00\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regini_31bf3856ad364e35_10.0.15063.0_none_1d6a15a7f29f9ce6\regini.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timeout_31bf3856ad364e35_10.0.15063.0_none_9d7845f9ff136ab5\timeout.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.15063.0_none_64798615ecbbbc0e_xblgamesavetask.exe_e6e69c44 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.15063.0_none_92ce01ad7e234d32\PrintBrmUi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.15063.0_none_672535d5fd503c22\IMJPSET.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.15063.0_none_310d74b5e708fd2f\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.15063.0_none_4af7924c6fd1f09a\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.15063.0_none_ad4e7885c0996412\UwfServicingShell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.15063.0_none_d6b9fc078f9b4d5a\MsMpEng.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.15063.0_none_0336a632576fedf7\adamsync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.15063.0_none_846cefae5692d559\SpeechModelDownload.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.15063.0_none_4e7f7ad6cb1d2087_lsass.exe_682060de e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.15063.0_none_32c810b14de21c09\dpapimig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.15063.0_none_44da5f4d5bf5bb92\pcalua.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-irftp_31bf3856ad364e35_10.0.15063.0_none_67ce1a25b7105221\irftp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_7237540a37a3d7c0\diskperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.15063.0_none_01175375b63af00c\ntprint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.15063.0_none_b9389646c80384de\SenseSampleUploader.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.15063.0_none_cc104740b5680cc1\dcomcnfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.15063.0_none_7a7f08f436397aad\FileExplorer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.15063.0_none_dd77edb228bb5599\fsutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.14917.0_none_cbb3591fb7f31c49\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.15063.0_none_a8b3eda4e166e81a\mshta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.15063.0_none_75a98a3f6547a1bf\bdeunlock.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.15063.0_none_2f06793a4bbe30eb\NisSrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_wpf-presentationhostexe_31bf3856ad364e35_10.0.15063.0_none_24e97106a08f266b\PresentationHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.15063.0_none_e72dde21b301025d\IMCCPHR.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.15063.0_none_bf07a2bb0f599355\unregmp2.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.15063.0_none_36f7177be1349e4a\pcaui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Boot\DVD\PCAT\etfsboot.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.15063.0_none_1bed0c2d78e461d9\SppExtComObj.Exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-datasvcutil_b03f5f7f11d50a3a_4.0.15552.17062_none_29034f8a62dfb1a8\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.15063.0_none_0180d21376396cad\ThumbnailExtractionHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_4.0.14917.0_none_3c9bd04a945ac138\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-globalserifcf_b03f5f7f11d50a3a_4.0.14917.0_none_40ed3e04b34e97ff\GlobalSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-generaltel_31bf3856ad364e35_10.0.15063.0_none_c67ebd76c63f878a\CompatTelRunner.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.15063.0_none_274a4fa06a760917\winrs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.15063.0_none_93bfa0dc9cb31395\regsvr32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15552.17062_none_b1ce58d87bc07b7d\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-attrib_31bf3856ad364e35_10.0.15063.0_none_cdf69e3cf963fb73\attrib.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_wpf-xamlviewer_31bf3856ad364e35_10.0.15063.0_none_0b038a36fd5e2ac1\XamlViewer_v0300.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.15063.0_none_4ffe4f5e09b56d8f\CloudExperienceHostBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.15063.0_none_c9310e116a596c46\shrpubw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.15063.0_none_32ed954229f16d57\auditpol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.15063.0_none_ad4e7885c0996412\uwfmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_10.0.15063.0_none_74b3815815b77883\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sigverif_31bf3856ad364e35_10.0.15063.0_none_ccad5d96342d5c13\sigverif.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-ldr64_exe_31bf3856ad364e35_10.0.15063.0_none_aead2ffb86786628\Ldr64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.15063.0_none_21fd4bfdeda110b4\aspnetca.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.15063.0_none_7bfeabd9337d55a1\vds.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-machine_config_ocm_b03f5f7f11d50a3a_10.0.15063.0_none_66ee37e29d9267b2\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.14917.0_none_df922cd6be85b32e\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.15063.0_none_1a79719cec9ecf66\licensingdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.15063.0_none_805aa901e17ffc08\rasdial.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.15063.0_none_db794e98e5d685bd\WSManHTTPConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.15063.0_none_420692083d1f600a_wininit.exe_7a527f28 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.15063.0_none_40a8c4b7933fc6d3\OneDriveSetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.15063.0_none_97696018c8b23180\hdwwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-machine_config_ocm_b03f5f7f11d50a3a_10.0.15063.0_none_ae9b6eb9b20e90b8\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_10.0.15063.0_none_3a83aad74d9d5e68\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\rwinsta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.15063.0_none_f9f50ac2838d283b\DeviceEject.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.14917.0_none_c1555a3aa3293b17\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.15063.0_none_f832a2d8814fee11\prevhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.15063.0_none_0dbf7ea91dc966a4\Microsoft.Uev.CscUnpinTool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.15063.0_none_dd86505400f5b57f\AppVNice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.15063.0_none_2f06793a4bbe30eb_nissrv.exe_f967cd63 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.15063.0_none_8a6a790ce079de7f\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..flicklearningwizard_31bf3856ad364e35_10.0.15063.0_none_1e958769aa92cd94\FlickLearningWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.15063.0_none_97efccaa8d61e3b6\net1.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.15063.0_none_a9ed1e721cef970f\BackgroundTransferHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.15063.0_none_e8ff03ea94e0988c\iscsicpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_1a733a82001933cc\poqexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.15063.0_none_556c8fbf8012d1cb\ShellLauncherConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.15063.0_none_7178a19b3012e0cd\netbtugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.15063.0_none_3691d83e94df4567\taskkill.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.15063.0_none_30474456cd289ff6\RdpSa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.15063.0_none_7e2521da60cd491c\windeploy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-runas_31bf3856ad364e35_10.0.15063.0_none_14dd86f9dddeaad9\runas.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_4b34a2e04284f71c\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.PPIProjection_cw5n1h2txyewy\Receiver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_43dacce387acdc1b\HOSTNAME.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.15063.0_none_a98130f2e25a891f\wextract.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.15063.0_none_1ac740c66a545115\WSCollect.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.15063.0_none_b4b47a660d02b7bf\SearchProtocolHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.15063.0_none_d969cfebbd8b347c\hh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.15063.0_none_34f6368d92872944\fltMC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wpf-globalmonospacecf_31bf3856ad364e35_10.0.15063.0_none_95020711e8efcddc\GlobalMonospace.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..pgrade-subscription_31bf3856ad364e35_10.0.15063.0_none_6282db77610a6450\ClipRenew.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.15063.0_none_f4f5cf31388ea241\wbengine.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.15063.0_none_2b7530b159c1ac4e_sppsvc.exe_fc6922a9 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.15063.0_none_1e476b971af580e8\MsSpellCheckingHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.15063.0_none_a4ea7575b2863db1\MdSched.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.15063.0_none_a2210cbd85f56f63\TrustedInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.15063.0_none_811af5db75980aa1\WerFaultSecure.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_vmconnect6.3_31bf3856ad364e35_10.0.15063.0_none_b76da3105535ab7f\vmconnect6.3.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_4.0.14917.0_none_2135fe736c2110ed\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.15063.0_none_a4f014f99ec97d3c\cttunesvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.15063.0_none_44fadb58fe4497d9\dwm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..icfirstrun.appxmain_31bf3856ad364e35_10.0.15063.0_none_83dc6003e01c7937\MixedRealityPortal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.15063.0_none_85c52dd741150836\stordiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.15063.0_none_d9547d404c10cc00\TsWpfWrp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-snmp-evntcmd_31bf3856ad364e35_10.0.15063.0_none_6dfa055684766ac6\evntcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.15063.0_none_f7081616f7fcd140\autofmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.15063.0_none_56564b5f3929ef1c\BioIso.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\servicing\TrustedInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\resmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.15063.0_none_502c9ea83571f8dd\services.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.15063.0_none_1371040ac337bde6\lodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sort_31bf3856ad364e35_10.0.15063.0_none_c726a6de86b265c9\sort.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wpf-globaluserinterfacecf_31bf3856ad364e35_10.0.15063.0_none_bf12135becb71e63\GlobalUserInterface.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.15063.0_none_769d7d49d0c8eb0b\diskraid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.15063.0_none_2aa18c3b5e266749\fltMC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.15063.0_none_767a268eea91c3f3\rdrleakdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_10.0.15063.0_none_a4d909d870ff99e0\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.15063.0_none_9c8957931f35792d\InetMgr6.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icacls_31bf3856ad364e35_10.0.15063.0_none_43c87849dec8eac3\icacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.15063.0_none_6faf1624e6304a08\RdpSaUacHelper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.15063.0_none_1d8f51da5f06e135\GameBarPresenceWriter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.15063.0_none_dbcef91746073ee0\CredentialUIBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-dw_b03f5f7f11d50a3a_10.0.15063.0_none_3f3fca3ba322351b\dw20.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.15063.0_none_4a395d1c23946704_appidtel.exe_b664fbc5 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.14917.0_none_2d68701fa94905ab\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-globalmonospacecf_b03f5f7f11d50a3a_4.0.14917.0_none_d95fba1dac380387\GlobalMonospace.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.15063.0_none_221fe8572e1b8efd\RunLegacyCPLElevated.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.15063.0_none_f5ad4336b7886518\LsaIso.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.15063.0_none_c5177aba769d526d\lpq.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.15063.0_none_c428bdd8a5a35794\djoin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.15063.0_none_7f80dd93c3723e4f\_isdel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.15063.0_none_5a1e4d3d94800cab\GamePanel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.15063.0_none_0e779bcaf5563fd6\pnputil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.15063.0_none_f45d851523f9219a\perfhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.15063.0_none_98e77699f3e6352a\InetMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.15063.0_none_41f87041e713b7c7\aitstatic.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.15063.0_none_420692083d1f600a\wininit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.15063.0_none_6c3a936ba57599b0_winload.exe_75835076 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.15063.0_none_7e87512a075903a1\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.15063.0_none_c08648c3335584e3\DeviceCensus.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.15063.0_none_13bd89286a0c083a\Utilman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.15063.0_none_b8efbb5654d028f8\clip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.15063.0_none_2de833670beadc3d\adamuninstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mail-app_31bf3856ad364e35_10.0.15063.0_none_026c06c18883ec63\WinMail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.15063.0_none_6fc3bae99f1dce71\WpcTok.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_7237540a37a3d7c0\typeperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.15063.0_none_f0874b6193bffceb\MultiDigiMon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.15063.0_none_de8f9bbf3d0c38b3\NetHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.15063.0_none_7bfeabd9337d55a1_vds.exe_cb461c29 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-timeout_31bf3856ad364e35_10.0.15063.0_none_4159aa7646b5f97f\timeout.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.15063.0_none_7a4c7063c5995781\winresume.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-format_31bf3856ad364e35_10.0.15063.0_none_41f1663df7290e3c\format.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-where_31bf3856ad364e35_10.0.15063.0_none_12c876d55e9bdb39\where.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-globaluserinterfacecf_b03f5f7f11d50a3a_4.0.14917.0_none_110eb3d0df99ed56\GlobalUserInterface.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.15063.0_none_50bfec2eff22eeb0\InputPersonalization.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-findstr_31bf3856ad364e35_10.0.15063.0_none_42980eedc6e422e7\findstr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.15063.0_none_156275260899e876\dplaysvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.15063.0_none_ab72fec635277db5\nltest.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.15063.0_none_036d9697dd29e050\charmap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.15063.0_none_bc611a88528e688d\fixmapi.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.15063.0_none_acba7ecbeae0a029\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.15063.0_none_813120118f809dfc\cliconfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.15063.0_none_e55345229a65d327\wsqmcons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.15063.0_none_64798615ecbbbc0e\XblGameSaveTask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-tasklist_31bf3856ad364e35_10.0.15063.0_none_dd386fe6dac2ecc1\tasklist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.15063.0_none_f387fb9c810fa2b6\hdwwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_jsc_b03f5f7f11d50a3a_4.0.15552.17062_none_b7205562ffbc3d7e\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.15063.0_none_f923819944a6f585\hvsievaluator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\Taskmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_environmentsapp.appxmain_31bf3856ad364e35_10.0.15063.0_none_9e40f7707cfe3e0a\EnvironmentsApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.15063.0_none_556c8fbf8012d1cb\eshell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.15063.0_none_762b11bba87afc55\gpscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packageinspector_31bf3856ad364e35_10.0.15063.0_none_7b95e107f7fe4a21\PackageInspector.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.15063.0_none_d5912ea96a7261c1\vssadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.15063.0_none_36572f6bfbb2c91a\dccw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.15063.0_none_a449eed0790015b7\systeminfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.15063.0_none_7a88c2fccdb50852\cmdl32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.15063.0_none_8a580e59c005242e\eventcreate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.15063.0_none_858214520d7b6bf8\sc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.15063.0_none_4a395d1c23946704\appidtel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.15063.0_none_ec056a6583c87c56\psr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-recover_31bf3856ad364e35_10.0.15063.0_none_a17bd15a21ca7ad5\recover.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.15063.0_none_af6b1cb112ce3d3c\phoneactivate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.14917.0_none_5b51e2bcbf0b54e6\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-autofmt_31bf3856ad364e35_10.0.15063.0_none_9ae97a933f9f600a\autofmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.15063.0_none_ad4e7885c0996412\UwfServicingSvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.15063.0_none_7d2c695b66e56a55\HelpPane.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.15063.0_none_7e5e2e34617bbade\xcopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-credwiz_31bf3856ad364e35_10.0.15063.0_none_54cfee60ec4666ba\credwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.15063.0_none_87b39d601d6e7942\audiodg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.15063.0_none_060bb1403c81dd6a\eventvwr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_10.0.15063.0_none_37712666eadab61b\etfsboot.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.15063.0_none_83e9bd0b05bcde46\wiaacmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\chgusr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_4.0.14917.0_none_0b42cee69f56fa2c\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.15063.0_none_f136c46dcd641bde\ByteCodeGenerator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.15063.0_none_00688a54315d86ed\systeminfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.15063.0_none_5d4dca3950bd5bb9\ipconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.15063.0_none_18fdca143ee4528f\bridgeunattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.15063.0_none_ac29a10019bef2b0\tpmvscmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-osk_31bf3856ad364e35_10.0.15063.0_none_c62556f7c71e2ce4\osk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_4.0.15552.17062_none_8ac3d9c14965c12f\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.15063.0_none_21de0dff2c3f5f1f\CameraSettingsUIHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_4e2f7735bc0d9e16\MRINFO.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_317fcc28622ee811\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..dapplauncher-client_31bf3856ad364e35_10.0.15063.0_none_592acdf8abfdb99a\embeddedapplauncher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.15063.0_none_db8245e05ac92df5\MuiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.15063.0_none_55c13af60dfee201\colorcpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-convert_31bf3856ad364e35_10.0.15063.0_none_51ca887128c37c31\convert.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_10.0.15063.0_none_a37fe183045d089f\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.15063.0_none_63462ab9ab45c943\net.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-smsvchost_b03f5f7f11d50a3a_4.0.14917.0_none_b1152862529fe87c\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.15063.0_none_9234ad40ead4b732\InetMgr6.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.14917.0_none_7898f2760c9f0c5f\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.15063.0_none_c4f067d86940c645\plasrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.15063.0_none_ff774a02302f9246\WMPDMC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.15063.0_none_dd86505400f5b57f\ScriptRunner.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ftp_31bf3856ad364e35_10.0.15063.0_none_61e09ba5d8fb45e8\ftp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.15063.0_none_04aa902bc775997f\CertEnrollCtrl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.15063.0_none_36633429ad2a3b40\wmlaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.15063.0_none_2bd1e3a1cfd67be0\SystemSettings.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-comsvcconfig_b03f5f7f11d50a3a_4.0.14917.0_none_39243a8427e12bab\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.15063.0_none_1c7d9c5887e872fd\wmpconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.15063.0_none_e008588ebe1a4f7c\wiaacmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.15063.0_none_5be600a191b01a2d\scrcons.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.15063.0_none_c26c1832728e7e34\odbcconf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.15063.0_none_c698e1266c2b4c34\certutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-installer_31bf3856ad364e35_10.0.15063.0_none_1525b04a87b3edd7\LxRun.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.15063.0_none_d8b8d5e7de354102\dxdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_windows-defender-service_31bf3856ad364e35_10.0.15063.0_none_d6b9fc078f9b4d5a_msmpeng.exe_2f1c6923 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.15063.0_none_7f41b0a5d17e992b\Magnify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.15063.0_none_e3081a9148d3fced\repair-bde.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.15063.0_none_50bfec2eff22eeb0\ShapeCollector.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.15063.0_none_d2fa3319c57f36f8\chkdsk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.15063.0_none_c8e2de6b6854073d\provtool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.15063.0_none_74ec81186e27886e\IMTCLNWZ.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.15063.0_none_94fac2eb5f00ca4b\UserOOBEBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.15063.0_none_f41da0f520fcf339\mqsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.15063.0_none_c49a2892fd0a43b8\PATHPING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_10.0.15063.0_none_e0486c662566aea8\Locator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.15063.0_none_672225bab5bb9bf7\XamlViewer_v0300.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.15063.0_none_6d9ad50bdfa68b3e\net.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.15063.0_none_811af5db75980aa1\WerFault.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_10.0.15063.0_none_0ba1e8fb38f0aa68\RDVGHelper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.15063.0_none_377913f61610f2d8\wksprt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..sktop.appxmain.root_31bf3856ad364e35_10.0.15063.0_none_ec24e4a0e74d86ea\RemindersShareTargetApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.15063.0_none_4fac586470568bab\tzutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.15063.0_none_326d3a42a5473084\lpremove.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.15063.0_none_7bfeabd9337d55a1_vdsldr.exe_20c491b3 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_4.0.14917.0_none_36e051080443881b\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.15063.0_none_5d42ddc236d7d889\dcdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.15063.0_none_31e111d878a50313\edpnotify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.15063.0_none_9b5dc11a36ecc972\Eap3Host.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_c53b9c03c7b5d8af_fontdrvhost.exe_94bdc76d e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\DesktopLearning_cw5n1h2txyewy\DesktopLearningApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.15063.0_none_50ad095d0842253e\dsdbutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-wsatconfig_b03f5f7f11d50a3a_4.0.14917.0_none_24d599acd1661a63\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_10.0.15063.0_none_93259c8df4d21239\BitLockerToGo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_jsc_b03f5f7f11d50a3a_4.0.14917.0_none_1b8f95d2a61ddb64\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.15063.0_none_7b9c596abcc179e5\provlaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.15063.0_none_0f17c050630a7015\SensorDataService.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.15063.0_none_1135354955f4a3d3\SMConfigInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.15063.0_none_b5bbe238b5cd9a4c\comp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.15063.0_none_4d62956f29fd17e9\iexpress.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.15063.0_none_a1cd01d173b58dd9\PkgMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.15063.0_none_cf31b229dc87b1a1\Narrator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_inspectvhddialog6.2_31bf3856ad364e35_10.0.15063.0_none_d8ebef6457fe3f6c\InspectVhdDialog6.2.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.15063.0_none_9f10ad5bd073e16c\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.15063.0_none_ed1af4bda909fc45\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.15063.0_none_11da7dbc6e2b0b82\comp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.15063.0_none_8ee6ac35063f8d3f\dpapimig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_4e2f7735bc0d9e16\ARP.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.15063.0_none_389a4fa1590cd1ac\UserAccountControlSettings.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.15063.0_none_5b31e53ae31bd4fa\spaceman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.15063.0_none_ac29a10019bef2b0\tpmvscmgrsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.15063.0_none_696ff17e64c42bbd\WFServicesReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-dfsvc_b03f5f7f11d50a3a_4.0.14917.0_none_bed6128d0bd81c9a\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.15063.0_none_b75e366b959a24e0_consent.exe_9075a1c2 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.15063.0_none_ac938d72130f980b\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.15063.0_none_8b6fa02da9f8cc9c\WerFaultSecure.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.15063.0_none_2c0e89d778c97945\wmlaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_32122b5ce7c5dcad\find.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_7e580f9a965a8a9b\cleanmgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.15063.0_none_73434761d0c02ccc\wpr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.15063.0_none_0af708675c284264\wlanext.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.15063.0_none_0c217c20ad81aef1\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.15063.0_none_ba457e40c8a981bd\PATHPING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.15063.0_none_20edd7ef9e21d8cb\rasautou.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-expand_31bf3856ad364e35_10.0.15063.0_none_0d67ba31d851b93a\expand.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-bootexp_31bf3856ad364e35_10.0.15063.0_none_da7530b33c88b5c6\BootExpCfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_8e30c6e0a0234de3\doskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.15063.0_none_edfb4bfe15a6bcb5\cmdkey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_be4658e9f911ed66\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.15063.0_none_b75e366b959a24e0\consent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.15063.0_none_53bd36ba106157ca\wabmig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.15063.0_none_c22e3ca753e67e6c\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.15063.0_none_26d246aabc4934f8\wmpshare.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_8e30c6e0a0234de3\tree.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.15063.0_none_21fd4bfdeda110b4\iisrstas.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.15063.0_none_689a308dc3e71916\BitLockerWizardElev.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-dialoghost_31bf3856ad364e35_10.0.15063.0_none_45b8a69fcfd72d8c\PrintDialogHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.15063.0_none_703418aa99544657\cmmon32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.15063.0_none_a0561a8759977fdf\wkspbroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_1a733a82001933cc\TiFileFetcher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.15063.0_none_37285a6bde632bf8\bfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-atbroker_31bf3856ad364e35_10.0.15063.0_none_8495ed869ec68026\AtBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\qprocess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.15063.0_none_c9456a9e5dd923ee\telnet.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-newdev_31bf3856ad364e35_10.0.15063.0_none_c66b8909d11a5fe5\ndadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\write.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.15063.0_none_49ca803e8c3ee2ca\SystemPropertiesRemote.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.14917.0_none_3466e7ee6120f0da\ngentask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.15063.0_none_a60f9982853b9f8e\ProximityUxHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.15063.0_none_26d246aabc4934f8\wmpconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..experience.appxmain_31bf3856ad364e35_10.0.15063.0_none_43ad614639f77b98\SecondaryTileExperience.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.15063.0_none_07c5c792f6bbce38\MBR2GPT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.15063.0_none_8b0f429dfaa39127\IMCCPHR.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.14917.0_none_8c829e802737414f\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.15063.0_none_fb5e3c3c72b7be23\DeviceProperties.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.15063.0_none_01e35b1fa20d9246\makecab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.15063.0_none_73d41832adea07b9\sethc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.15063.0_none_c49a2892fd0a43b8\PING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.15063.0_none_c0328c9e014ba8d0\imjpuexc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.15063.0_none_92ce01ad7e234d32\PrintBrm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.15063.0_none_43405787e61101ff\Setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.15063.0_none_7f80dd93c3723e4f\setup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.15063.0_none_21fd4bfdeda110b4\appcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.15063.0_none_2a66dc1e98d1b4ea\msdtc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..holocamera.appxmain_31bf3856ad364e35_10.0.15063.0_none_0e4b17ee0e0d1f90\HoloCameraApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.15063.0_none_3830d2bda4126472\IEExec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_f5dc2ec982476ba8\iscsicli.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-rundll32_31bf3856ad364e35_10.0.15063.0_none_8cfa8f452b5bdb16\rundll32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.15063.0_none_11c96e64248ffa9d\vfpctrl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.15063.0_none_49024ce85d9f3b44\AssignedAccessLockApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.15063.0_none_149aa50c07625ad6\wmpnetwk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.15063.0_none_d1d7cd66cac70958\WmsSvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-serviceworkerhost_31bf3856ad364e35_10.0.15063.0_none_f85cac2e43af7bfe\ServiceWorkerHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.15063.0_none_685fe984eaf6056e_appidcertstorecheck.exe_03352f5f e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.15063.0_none_aa7fd276e34c8dd5\control.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.15063.0_none_6c3a936ba57599b0\winresume.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.15063.0_none_7eb2219559258c2e\Register-CimProvider.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.15063.0_none_b4b47a660d02b7bf\SearchFilterHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.15063.0_none_ba457e40c8a981bd\PING.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..sktop.appxmain.root_31bf3856ad364e35_10.0.15063.0_none_ec24e4a0e74d86ea\PlacesServer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.15063.0_none_beb0ec29c4adcf87\SpeechRuntime.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.15063.0_none_89965af805df5b26\Magnify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.15063.0_none_bd1258ea3a066d7e\WMIC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupcl_31bf3856ad364e35_10.0.15063.0_none_69c2df0d2416a73c\setupcl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.15063.0_none_a539659cd48c0584\SlideToShutDown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.15063.0_none_dd86505400f5b57f\SyncAppvPublishingServer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.15063.0_none_b2bdae9805a5ab83\WMIC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.15063.0_none_ce75a5a058f0fe9f\smartscreen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.15063.0_none_13bd6038fc5ee6d4\sapisvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rascmak.resources_31bf3856ad364e35_10.0.15063.0_en-us_4c5a9c6a655e1fe7\cmstp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_windows-defender-service_31bf3856ad364e35_10.0.15063.0_none_d6b9fc078f9b4d5a_mpcmdrun.exe_1d1038c2 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe_31bf3856ad364e35_10.0.15063.0_none_f0b22df7eb3a6b30\MSchedExe.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.15063.0_none_cbcdb1a89e8dbb3e\RdpSaUacHelper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_bae6f1b1935516b4_fontdrvhost.exe_94bdc76d e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_4e2f7735bc0d9e16\ROUTE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\config.json e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.14917.0_none_c395980f8adad126\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.15063.0_none_12c1fc6452d8d937\dvdplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.15063.0_none_dd50b800a1b37932\upnpcont.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\EnvironmentsApp_cw5n1h2txyewy\EnvironmentsApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.15063.0_none_7d443ad9ecf1cbd0\ntoskrnl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_multipoint-wmsdashboard_31bf3856ad364e35_10.0.15063.0_none_6140500624a8a26d\WmsDashboard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.15063.0_none_3843649b928360ec\findstr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.15063.0_none_6a97d6c639c6c673\IMTCLNWZ.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.15063.0_none_896af68a6852519a\regsvr32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.15063.0_none_d123dd2c727d3948_svchost.exe_4dd0f0bc e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15552.17062_none_d1070f422cdb5129\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.15063.0_none_0d02d004261cbb8b\setupugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.15063.0_none_bad1da74538ab165\calc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.15063.0_none_e676a9dd78629564\eventcreate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.15063.0_none_cb784ea0be5fa082\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.15063.0_none_dd86505400f5b57f\AppVShNotify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.15063.0_none_bf8fd14b74ad4dc1\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.15063.0_none_d217afe3f4f60785\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_7237540a37a3d7c0\logman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.15063.0_none_ac29a10019bef2b0\rmttpmvscmgrsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.15063.0_none_41870b8a750cb766\SystemPropertiesComputerName.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.15063.0_none_d8b2fd3769d37ade\CastSrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-snmp-agent-service_31bf3856ad364e35_10.0.15063.0_none_129d64f2c572542f\snmp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.15063.0_none_e819281ea9bc03bf_axinstui.exe_eba3b15b e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.15063.0_none_a31b751aca0bb1d3\CloudNotifications.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.15063.0_none_31bff7db56b1ad74\SystemSettingsAdminFlows.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\tskill.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.15063.0_none_c2b897ecb577de4b\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.15063.0_none_393a5d12f5d3e91a\mqtgsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.15063.0_none_464c31d1cc57d927\rdpsign.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.15063.0_none_f2d6740039213562\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_03876c092e08ce16\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_5ce619cafcc79d31\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.15063.0_none_224b97ad28ee338b\MicrosoftEdge.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-verclsid_31bf3856ad364e35_10.0.15063.0_none_70dc0eeb93e59452\verclsid.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.15063.0_none_9b27e4d519ac89ce\isoburn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.15063.0_none_41652c9a9e54011f\hvax64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.15063.0_none_1c512821b9a91a06\imjpuexc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.15063.0_none_80b23ae73adb4199\DevicePairingWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.15063.0_none_ea9fc636fe0fda95\esentutl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.15063.0_none_5ac8e66dc4f41fb7\Fondue.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.15063.0_none_fb8b6ec001c4ddd9\ByteCodeGenerator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-dictionaryupdate_31bf3856ad364e35_10.0.15063.0_none_32fc99cb9c722047\IMEDICTUPDATEUI.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-v..atamodel-comservers_31bf3856ad364e35_10.0.15063.0_none_c5c61eb9002a3ffc\tdlrecover.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.15063.0_none_dc0656bce066dc13\wmprph.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-getmac_31bf3856ad364e35_10.0.15063.0_none_c0f3d470226c5a9b\getmac.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.15063.0_none_0dbf7ea91dc966a4\UevAgentPolicyGenerator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.15063.0_none_802e66b4a8ce74db\notepad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.15063.0_none_b5bbe238b5cd9a4c\fc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-more_31bf3856ad364e35_10.0.15063.0_none_c7c2d3f6863e2aa0\more.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.15063.0_none_4f252606090fd1ee\bootim.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.15063.0_none_41652c9a9e54011f\hvloader.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.15063.0_none_153890ea9cc18bad\rdpinput.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.15063.0_none_bff63621e2683299\wuauclt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-robocopy_31bf3856ad364e35_10.0.15063.0_none_7bfc6d366cd584eb\Robocopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-more_31bf3856ad364e35_10.0.15063.0_none_bd6e29a451dd68a5\more.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.15063.0_none_ba457e40c8a981bd\TRACERT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.15063.0_none_0cba64789bfd5c16\LockAppHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.15063.0_none_fc2457edb4cdc66c\systemreset.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.15063.0_none_3a3d4a9ae4d3d7ea\qwinsta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\bfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.15063.0_none_15e137df821b01cf\icsunattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Fonts\GlobalMonospace.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\ModalSharePickerHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.15063.0_none_c3a1f3eac5033978\attrib.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_32122b5ce7c5dcad\tree.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.15063.0_none_e02963baab306366\DismHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.15063.0_none_5e256a3b453ac566\bitsadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.15063.0_none_df275424af63715a\WorkFolders.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.15063.0_none_69f7bd111ce467b4_csrss.exe_06529458 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-calc_31bf3856ad364e35_10.0.15063.0_none_c52684c687eb7360\calc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.15063.0_none_750108312cada29c\eudcedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.15063.0_none_5e157da2bcb33f1d\at.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.15063.0_none_2401858fc6237877\rrinstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_f5dc2ec982476ba8_iscsicli.exe_20e14d4f e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.15063.0_none_eb4bcfc81d5ff4dc\ddodiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_10.0.15063.0_none_2c7254a45fb26c58\TpmInit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.15063.0_none_e0b4890a5723f15c\AtBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.15063.0_none_f307c682fa8fdc57\autochk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.15063.0_none_57637684bbf7b866\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_10.0.15063.0_none_cbaa590df0d6f1ef\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.15063.0_none_7b70c48a870a37e2\browser_broker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-evntcmd_31bf3856ad364e35_10.0.15063.0_none_ca18a0da3cd3dbfc\evntcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_32122b5ce7c5dcad\replace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.15063.0_none_5bea471037c04edb\dsmgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.15063.0_none_e75f7c5afa577e7e\splwow64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.15063.0_none_f93fa22542a6826c\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_4.0.15552.17062_none_7b22ec6718241548\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.15063.0_none_7da85cf8d4de2361\InfDefaultInstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.15063.0_none_ac3dc58d64b7b416\SystemPropertiesAdvanced.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_eb8784774de6a9ad\iscsicli.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.15063.0_none_4403434aa91e2007\fodhelper.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.15063.0_none_c5c1f5efcbd6de1e\nfsadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.15063.0_none_80d298c79ce088f2\RMActivate_ssp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.0_none_4922fcbeda150024\wordpad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_10.0.15063.0_none_3604edf26d582c13\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.15063.0_none_24939f63827dd063\DevicePairingWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.15063.0_none_7e2521da60cd491c\oobeldr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.15063.0_none_0baa37e4137c6d4c\SpaceAgent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.15063.0_none_44fadb58fe4497d9_dwm.exe_04cf416e e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_4.0.15552.17062_none_1829ead3dfc61a50\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.15063.0_none_19695006dbf26181\quickassist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.15063.0_none_ca67dc4e5867595b\WmiApSrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.15063.0_none_505ddd3c336d55b8\wowreg32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.15063.0_none_ccf9db72e2edfd53\Windows.Media.BackgroundPlayback.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.15063.0_none_63d0d6a16d896cde\cscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.15063.0_none_eb8e17bcd68ec9f9\msconfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_10.0.15063.0_none_47086791d6bf0f2c\FlashUtil_ActiveX.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_10.0.15063.0_none_39fa0c051f7a048c\MdRes.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.15063.0_none_c46888c5f61386ec\mmc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_1618b8867f46668a\tracerpt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.15063.0_none_dd86505400f5b57f\AppVStreamingUX.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.15063.0_none_358e683ac9c0f095\sdiagnhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.15063.0_none_bcdfe8328c492787\rekeywiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.15063.0_none_6d901fca2e11e148\CCG.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.15063.0_none_d1b1ac6aac061a18\wmprph.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.15063.0_none_091c59b88ed6fbeb\lodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-snmp-provider_31bf3856ad364e35_10.0.15063.0_none_bbcf57c2ff8e77de\smi2smir.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-session0viewer_31bf3856ad364e35_10.0.15063.0_none_f2fac13b7f7cb7da_ui0detect.exe_639495e3 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.15063.0_none_139ee0cd8e1db378\Dism.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.15063.0_none_e9192ac8e3b94c4c\rundll32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.15063.0_none_d78bd3313ed0c918\WSReset.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.15063.0_none_c7798f1ab4025250\waitfor.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-microsoft.workflow.compiler_b03f5f7f11d50a3a_4.0.15552.17062_none_c6aea04e772bb3d8\Microsoft.Workflow.Compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.15063.0_none_3c35bc2aad05c50e\edpnotify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_8e30c6e0a0234de3\subst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.15063.0_none_c36d52a68a42056a\mountvol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudstoragewizard_31bf3856ad364e35_10.0.15063.0_none_05819e6dc6666159\CloudStorageWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-edmgen_b03f5f7f11d50a3a_4.0.15552.17062_none_5f3ba588162c68d4\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-snmp-evntwin_31bf3856ad364e35_10.0.15063.0_none_6bc601c685ed70a8\evntwin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.15063.0_none_3a3d4a9ae4d3d7ea\msg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.15063.0_none_6a07ea0c7152a3e8\xwizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-media-cap..ternal-broadcastdvr_31bf3856ad364e35_10.0.15063.0_none_c888d6504eccbedd\bcastdvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.15063.0_none_05428e9e14a75fff\regedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-taskkill_31bf3856ad364e35_10.0.15063.0_none_da733cbadc81d431\taskkill.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.15063.0_none_71ef63d3904063fe\WmsUserAgent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.15063.0_none_75c97354fd414fba\wevtutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.15063.0_none_486bf0653ab487af\msra.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.15063.0_none_dd4edd6bf9dff8f3\chkdsk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.15063.0_none_0fcbeae5834b8560\SystemPropertiesPerformance.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.15063.0_none_8cfc5cde3d1f6432\WmsSelfHealingSvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.15063.0_none_1c7d9c5887e872fd\wmplayer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.15063.0_none_5ef026ce59e64966\mstsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.15063.0_none_74ec81186e27886e\IMTCPROP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.15063.0_none_bbd0aca592bd6ae9\osk.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.15063.0_none_e3be7a3df1ebf677\hh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\MiracastView\MiracastView.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_814bf8d8ee6b3ebf\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.15063.0_none_c6d59a10fd695c44\FsIso.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.15063.0_none_9a0f7ba34dad431e\wimserv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.15063.0_none_43405787e61101ff\audit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.15063.0_none_b1c695092fbfd7f6\WinMgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.15063.0_none_bc5df2ee9ea7994d\RMActivate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.15063.0_none_18a794839cf4fbd3\SystemPropertiesProtection.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.15063.0_none_999dd15739f791d8\ktmutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.15063.0_none_87b39d601d6e7942\vac.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\HelpPane.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_32122b5ce7c5dcad\subst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_10.0.15063.0_none_feac1ade33c16c7c\hwrreg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.15063.0_none_b9389646c80384de\MsSense.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_10.0.15063.0_none_34c82b94bd86254b\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-t..acyinkingcomponents_31bf3856ad364e35_10.0.15063.0_none_f6e709810a069163\pipanel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_aa29e7f7c913acd1\dfrgui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-addinutil_b03f5f7f11d50a3a_4.0.15552.17062_none_cd46a3e1e2aeb3d2\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.15063.0_none_1e92236e3c0062a9\msoobe.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.15063.0_none_98cbc9b105ccf277\secinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.15063.0_none_1d16a6b687399b32\dvdplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-grpconv_31bf3856ad364e35_10.0.15063.0_none_577d6293be1f2131\grpconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.15063.0_none_bbdc5c1c56a0a003\fsavailux.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.15063.0_none_43a3a01107d97fc5\WWAHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.15063.0_none_3fe4b2c9ef33a509_appidtel.exe_b664fbc5 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\MixedRealityPortal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.15063.0_none_9ec3f4f81fcabddb\IcsEntitlementHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.15063.0_none_319ef9f29ed6cb12\winrs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.15063.0_none_9e471bb4701afe5d\RMActivate_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.15063.0_none_41ab04018589ba56\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.15063.0_none_f41da0f520fcf339\mqbkup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-csvde_31bf3856ad364e35_10.0.15063.0_none_1033690d62f602b9\csvde.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_10.0.15063.0_none_5bd2aaabefe0df99\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.14917.0_none_5dead01f369e4269\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.15063.0_none_fb1d577ac83dd116\comrepl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.15063.0_none_0aff3f034e6cd363\takeown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.15063.0_none_3c52a6762414eb2d\sfc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.15063.0_none_7b0b6115a0fbb545\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.15063.0_none_133aa7882aa61f3a\GameBarPresenceWriter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.15063.0_none_b7c935afc97fab43\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.15063.0_none_0dbf7ea91dc966a4\UevTemplateConfigItemGenerator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.15063.0_none_0726d88040adbf08\user.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.15063.0_none_e7cc98045d1c1794\fsutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.15063.0_none_f9192c6b73f349a8\dllhst3g.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_674418b011917e63\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.15063.0_none_217697c4c433c32f\WmiPrvSE.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmcreate_31bf3856ad364e35_10.0.15063.0_none_e85b4993a3dda001\VMCreate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-consolehost-launcher_31bf3856ad364e35_10.0.15063.0_none_8c3cd518ba124ec2\conhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.15063.0_none_75b98d45dde63eac\BdeUISrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.15063.0_none_c0046e64ff7e7979\CheckNetIsolation.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.15063.0_none_d123dd2c727d3948\svchost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\PlacesServer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-localservicebroker_31bf3856ad364e35_10.0.15063.0_none_013f7796136dc798\LocalServiceCredUIBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-dialoghost3d_31bf3856ad364e35_10.0.15063.0_none_f84efaddd7ac3203\PrintDialogHost3D.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.15063.0_none_9b5350ccee2513e8\schtasks.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.14917.0_none_8fa127181bfccae6\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.15063.0_none_0dbf7ea91dc966a4\UevTemplateBaselineGenerator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_10.0.15063.0_none_e09ed816783693f0\snmptrap.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.15063.0_none_b394e30a75f5f996\DWWIN.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15552.17062_none_177920c8cffd0a3a\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.15063.0_none_e624dcf78588902b\sdbinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.15063.0_none_0d5155faac66ba87\WFServicesReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.15063.0_none_3259fa94c3558942\LanguageComponentsInstallerComHandler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.15063.0_none_4a4a27e5ad4098e5\MusNotifyIcon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.15063.0_none_1c7d9c5887e872fd\wmpshare.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.15063.0_none_94b8eb25116a42e2\UserAccountControlSettings.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.15063.0_none_f7913da13edf736e\userinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.15063.0_none_0d44625d85ad157d\cacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.15063.0_none_0b091403ee6142bd\compact.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ls-adschemaanalyzer_31bf3856ad364e35_10.0.15063.0_none_e50cbdd46fa16ae3\ADSchemaAnalyzer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.15063.0_none_b7099c070629a280\SecurityHealthService.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.15063.0_none_d47ac445c491a593\choice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rascmak.resources_31bf3856ad364e35_10.0.15063.0_en-us_56af46bc99bee1e2\cmbins.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.15063.0_none_dd93d1b42972babe\wiawow64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.15063.0_none_7cee1967fc89261b\netiougc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.15063.0_none_6d12728db1fbfb10\shrpubw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.15063.0_none_b7c9556648694020\shutdown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_43dacce387acdc1b\MRINFO.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_4.0.14917.0_none_f4ee99737fde9832\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.15063.0_none_bb5b7353741c1951\dtdump.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.15063.0_none_d4bc86a08cc81b56\WMIADAP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.15063.0_none_243c0d7e29228ad2\rasphone.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.15063.0_none_ac29a10019bef2b0\immersivetpmvscmgrsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.15063.0_none_a1d9180d132bc038\DataStoreCacheDumpTool.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.15063.0_none_ac61897e9919512a\coredpussvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\reset.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.15063.0_none_3ece526ca5b43e29\wordpad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.15063.0_none_6341d9d1d815036c\sxstrace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_399ec201d9ef15b9\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.15063.0_none_bc1b3f5b642099f1_winmgmt.exe_8f8eb7b1 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.15063.0_none_8527167b4aa01897\MusNotificationUx.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\change.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..client-installagent_31bf3856ad364e35_10.0.15063.0_none_fae5e81a3ccb70bc\InstallAgent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.15063.0_none_123c40c4bf45ff24\AppResolverUX.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.15063.0_none_fdd58a325d4a2de2\DisplaySwitch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.15063.0_none_b7c7b2c779f125e6\mfpmp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_4.0.15552.17062_none_907f5903d97cfa4c\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.15063.0_none_4c7cd83914c2f8e9\gpupdate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.15063.0_none_47a9e0d997bb6f24\vmms.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.15063.0_none_5c68b659c7d471c9\wbadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.15063.0_none_2df22df6ff09f2ef\SIHClient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-systray_31bf3856ad364e35_10.0.15063.0_none_a846ba88767b5b8f\systray.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.15063.0_none_2b428241d2829ac6_rasautou.exe_477abe34 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_32122b5ce7c5dcad\mode.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.15063.0_none_605529e5390f9df7\ldp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.15063.0_none_5a954e05bee89c0d\msiexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.15063.0_none_154bb2b99089045f\wlanext.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.15063.0_none_2f076f752b2481f2\UIMgrBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-coresystemminpnp_31bf3856ad364e35_10.0.15063.0_none_1b70ea73251f149e_drvcfg.exe_8370a674 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.15063.0_none_740983e22d1af8e3\xcopy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_1429b206663d6e79\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.15063.0_none_e71c0c4d5bb092a5\MDEServer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.15063.0_none_0b2e96f0f0250bd0\manage-bde.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.15063.0_none_36da1a52f2dcda9b\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.15063.0_none_bcc29c4403c6219c\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.15063.0_none_41652c9a9e54011f\hvix64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.15063.0_none_c6014cd375be1dc7\RunLegacyCPLElevated.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.15063.0_none_9f3c46c576c7284f\AccountsControlHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..erience-parser-task_31bf3856ad364e35_10.0.15063.0_none_db2639cea4666169\MbaeParserTask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_1a733a82001933cc\TiWorker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-security-syskey_31bf3856ad364e35_10.0.15063.0_none_cd57d697a5f36207\syskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.15063.0_none_c35e08076ddb1808\LicenseManagerShellext.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.15063.0_none_0f9738f0490821fa\regedit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.15063.0_none_4a45d10e5ac1db0e\inetinfo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.15063.0_none_54513e5c39ad5f47\prevhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.15063.0_none_7b0703fcd3f8bf49\TapiUnattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-addinprocess_b03f5f7f11d50a3a_4.0.15552.17062_none_3811d1a1ac4ff173\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.15063.0_none_bb6bdf6143bab2e7\ComputerDefaults.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.15063.0_none_a562368fbddbfb77\ThumbnailExtractionHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.15063.0_none_0f075710a7c73872\DataUsageLiveTileTask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setx_31bf3856ad364e35_10.0.15063.0_none_bd8aaf0851df1c56\setx.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.15063.0_none_70b4cf7730a78bba\netsh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.15063.0_none_2189c1751c80b22b\InfDefaultInstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_05f38fc10d8e166c\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.15063.0_none_6c5204911b5373ef\csvde.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-driverquery_31bf3856ad364e35_10.0.15063.0_none_4b18092b157ae80e\driverquery.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.15063.0_none_7269bdce76f31ff6\bcdboot.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.15063.0_none_425608d5ac44a3c4\DiagnosticsHub.StandardCollector.Service.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.15063.0_none_085c61111d15254c\SystemPropertiesAdvanced.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.15063.0_none_3cb6cf1a2fbbd20f\AuthHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.15063.0_none_7a88c2fccdb50852\cmmon32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..client-installagent_31bf3856ad364e35_10.0.15063.0_none_053a926c712c32b7\InstallAgent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerupdateinstaller_31bf3856ad364e35_10.0.15063.0_none_a7d096d85307168e\ContainerUpdater.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..lepc-mobilitycenter_31bf3856ad364e35_10.0.15063.0_none_6badce134411d35c\mblctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.15063.0_none_acda54383114f33b\LocationNotificationWindows.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.15063.0_none_2b7530b159c1ac4e\sppsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\WindowPicker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.15063.0_none_fabbb282281ce7b7\mtstocom.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.15063.0_none_5577e678ef45bf6c\fontview.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.15063.0_none_db794e98e5d685bd\wsmprovhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.15063.0_none_a2267c9af28bf1ee\IMJPUEX.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.14917.0_none_6ef9dbc567e8360c\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_4.0.14917.0_none_13a4abe5aa8f2be0\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_4.0.15552.17062_none_6788349eefb164f4\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.15063.0_none_6c3a936ba57599b0\winload.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.15063.0_none_d38595d50ceb30bc\FilePicker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.15063.0_none_3a3d4a9ae4d3d7ea\quser.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.15063.0_none_d2fc0dae6d52b737\upnpcont.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.15063.0_none_1da23dcdce5946e2\bootsect.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.15063.0_none_74c6300755526d09\SystemPropertiesProtection.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.15063.0_none_fe1cf48f74bd336e\w32tm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.15063.0_none_c6cf32da3e1c774d_svchost.exe_4dd0f0bc e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.15063.0_none_cd6f3f91779aa112\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.15063.0_none_fe106fd6807e62b5\dsacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.15063.0_none_c44da5812b357e8b\mavinject.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.15063.0_none_52d095da4f679421\EhStorAuthn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.15063.0_none_5c0336e176732c9f\WpcMon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.15063.0_none_4b7b603814e3516a\ielowutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.15063.0_none_13e7f0ea00c6b156\shutdown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.15063.0_none_6ee7125916f94c6f\where.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\DesktopView_cw5n1h2txyewy\DesktopView.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.15063.0_none_3cb3bd3fa25e4d31\FlashUtil_ActiveX.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_7237540a37a3d7c0\relog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.15063.0_none_2737aacce0c7078e\InspectVhdDialog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Fonts\GlobalSansSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.15063.0_none_81080c8a58ec97a1\PresentationHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.15063.0_none_8ec19a008af39754\SpeechModelDownload.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.15063.0_none_689a308dc3e71916\BitLockerWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alluserinstallagent_31bf3856ad364e35_10.0.15063.0_none_2c9fd620914d1570\RDSPnf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_10.0.15063.0_none_b2056094a1cc3312\BdeHdCfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_1618b8867f46668a\relog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.15063.0_none_55f4c5b60c607d27\IMEPADSV.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.15063.0_none_e8105abd85cf210e\iexplore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.15063.0_none_762d19250dfccce2\fsquirt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.15063.0_none_ed4794d0c7002044\imecfmui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.15063.0_none_7e34a7e5ab829f02\OpenWith.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.15063.0_none_a7162dd0282f61d0\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.15063.0_none_a6754a48878c04d2\cmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_4.0.15552.17062_none_28135e1080d5a369\aspnet_compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.15063.0_none_dd86505400f5b57f\AppVDllSurrogate.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.15063.0_none_1d05d13997d98c96\certreq.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.15063.0_none_a06ab765d5c4f407\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.15063.0_none_d6b9fc078f9b4d5a\MpCmdRun.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.15063.0_none_11da7dbc6e2b0b82\fc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.15063.0_none_914941045ced5588\RmClient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-webcache_31bf3856ad364e35_11.0.15063.0_none_701340687003ca5a\WebCache.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-smsvchost_b03f5f7f11d50a3a_4.0.15552.17062_none_04f8b11b97c22190\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_4.0.14917.0_none_5d34a10d133cd61f\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.15063.0_none_16762672e1e270ec\wecutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.15063.0_none_805aa901e17ffc08\rasphone.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.15063.0_none_8f0ffb3c2690a505\LaunchWinApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.14917.0_none_c06001e719ae3106\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.15063.0_none_11d800298bea2ab9\repadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.15063.0_none_a0ff0be85fcae169\dsamain.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.15063.0_none_f05e3cb55c6587b3\gpresult.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.15063.0_none_20b352f87ecef2d8\CredDialogHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.15063.0_none_21fd4bfdeda110b4\iissetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.15063.0_none_e819281ea9bc03bf\AxInstUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.15063.0_none_0c01f35e6879ac8b\LinqWebConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.15063.0_none_84bb50e9f22fe30a\LaunchWinApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.15063.0_none_f2c047c84ac5541a\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.15063.0_none_0726d88040adbf08\setup16.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.15063.0_none_b39bfe17767c9267\grpconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\qappsrv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-v..atamodel-comservers_31bf3856ad364e35_10.0.15063.0_none_bb717466cbc97e01\tdlrecover.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_4.0.15552.17062_none_4316a2ea34e99829\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dusm_31bf3856ad364e35_10.0.15063.0_none_bd7fa62851de026b\dusmtask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.15063.0_none_520e5e790bc913f0\SystemPropertiesHardware.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_4.0.15552.17062_none_5f26579fe4793340\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.15063.0_none_8ca8d111f028b262\WinSAT.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_e384afd1611f03fa\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_b47e9249fd746ecc\dfrgui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.15063.0_none_1a0c7637f01d8b1f\gpscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ge-capture-pipeline_31bf3856ad364e35_10.0.15063.0_none_f7874c61413dfbcd\MixedRealityCapture.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.15063.0_none_dc944d299f4147ed\nslookup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-globaluserinterfacecf_b03f5f7f11d50a3a_4.0.15552.17081_none_64f20d1424bc5c85\GlobalUserInterface.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_4e2f7735bc0d9e16\finger.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-globalsansserifcf_b03f5f7f11d50a3a_4.0.14917.0_none_ef088c43ab7e4e50\GlobalSansSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.15063.0_none_d21079a1f5138aa0\verifier.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.15063.0_none_c49a2892fd0a43b8\TRACERT.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..actsupport.appxmain_31bf3856ad364e35_10.0.15063.0_none_a5ca1360f9ef4c6d\ContactSupport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.15063.0_none_777ad383267da96b\OptionalFeatures.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_4.0.14917.0_none_a6f12f4bb7bcfcb0\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.15063.0_none_428b8412911e391b\TSWbPrxy.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.15063.0_none_aa0c0d3e7ee02877\RMActivate_ssp_isv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.15063.0_none_2d1dc944849b5924\SpeechUXWiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..sktop.appxmain.root_31bf3856ad364e35_10.0.15063.0_none_ec24e4a0e74d86ea\ActionUriServer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.15063.0_none_2bfea1145bda5bae\GenValObj.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.15063.0_none_9128f94d0ea2af0e\imecfmui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-machine_config_b03f5f7f11d50a3a_4.0.14917.0_none_e479463f87b125d0\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\PrintDialog\PrintDialog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.15063.0_none_adc2ec279770e76a\PrintIsolationHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.15063.0_none_35a8e13e1f4851a4\wscadminui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-utilman_31bf3856ad364e35_10.0.15063.0_none_b79eeda4b1ae9704\Utilman.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.15063.0_none_6be0a7b050a62d2f\VSSVC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_3.5.15063.0_none_244e49cb7ea268e6\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\holocamera_cw5n1h2txyewy\HoloCameraApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.15063.0_none_5ec1b3443bbde782\dmclient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-clip_31bf3856ad364e35_10.0.15063.0_none_5cd11fd29c72b7c2\clip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.15063.0_none_6771310c94f65435\srdelayed.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.15063.0_none_701bfed8b503823d\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.15063.0_none_c475075c2e3186b7\SystemSettingsRemoveDevice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Speech\Common\sapisvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.15063.0_none_685fe984eaf6056e\appidpolicyconverter.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_10.0.15063.0_none_8815846f65bab26d_drvinst.exe_6593e92a e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.15063.0_none_762d19250dfccce2\bthudtask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.15063.0_none_6cd5a5d60e5909d1\Microsoft.AAD.BrokerPlugin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.15063.0_none_f0798749b9e95226\sdbinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-cipher_31bf3856ad364e35_10.0.15063.0_none_620bbd102589eb6d\cipher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.15063.0_none_0dbf7ea91dc966a4\UevAppMonitor.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.15063.0_none_57f3a920ec0db791\rstrui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-wusa_31bf3856ad364e35_10.0.15063.0_none_61f5cf32990e235e\wusa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.15063.0_none_bcf04010327d02a0\msinfo32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_4.0.15552.17062_none_62c7590ed1a26b11\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.15063.0_none_7a88c2fccdb50852\cmstp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.15063.0_none_9ad21e76304f87b4\ImeBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.15063.0_none_dbb55c5189ba2ad8\mip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-addinutil_b03f5f7f11d50a3a_4.0.14917.0_none_79631b289d8c7abe\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-f12chooser_31bf3856ad364e35_11.0.15063.0_none_85bacaf01ebaf46e\F12Chooser.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.15063.0_none_274a4fa06a760917\winrshost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.14917.0_none_274ca4ee536c0d06\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.15063.0_none_6a97d6c639c6c673\IMTCPROP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.15063.0_none_7a94e6523561204b\SyncHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-dfsvc_b03f5f7f11d50a3a_4.0.15552.17062_none_12b99b4650fa55ae\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-write_31bf3856ad364e35_10.0.15063.0_none_14780fe55d892581\write.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.14917.0_none_e1afe6a329d37c78\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.15063.0_none_460932e9ff0c93bd\wowreg32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_7b302da7988e461a\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.15063.0_none_1f1dd9002563ae1d\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_4.0.15552.17062_none_21a6073a7cb68dd3\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rascmak_31bf3856ad364e35_10.0.15063.0_none_21a039cab183985e\cmak.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.15063.0_none_80d6da500dc0355d\winlogon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_datasvcutil_b77a5c561934e089_4.0.15552.17062_none_0f61902ddb56c8b7\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.15063.0_none_84e990a469c1e246\SyncHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.15063.0_none_c61e2a60473afa97\WPDShextAutoplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx35linq-csharp_31bf3856ad364e35_10.0.15063.0_none_cc20ecbf949b20fe\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.15063.0_none_223cc5e3ff986bcd\WPDShextAutoplay.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-control_31bf3856ad364e35_10.0.15063.0_none_4e6136f32aef1c9f\control.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.15063.0_none_8a0d85a061351e49\FXSCOVER.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.15063.0_none_2d809fc786f719a7\ksetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wpf-globalsansserifcf_31bf3856ad364e35_10.0.15063.0_none_5f5f52f5344df345\GlobalSansSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.15063.0_none_cea24fd35f964086\mavinject.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.15063.0_none_c915eeedbb8ae8f1\PickerHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.15063.0_none_fdeb9d552c12ff0f\PkgMgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmsp_31bf3856ad364e35_10.0.15063.0_none_4654c29f9896fb55\vmsp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.15063.0_none_27bfea990d866233\UserAccountBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rascmak_31bf3856ad364e35_10.0.15063.0_none_2bf4e41ce5e45a59\cmak.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.15063.0_none_52af4bc5c129cc0a\RpcPing.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.15063.0_none_55b9db4481ac747a\OfflineScannerShell.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_4.0.15552.17062_none_2901705b638af3c2\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15552.17062_none_af356b76042d8dfa\AddInProcess32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.15063.0_none_730314b2672e2d8d\ExtExport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_4.0.15552.17062_none_48d2222cc500d146\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_8e30c6e0a0234de3\replace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.15063.0_none_49a4f8dbda83d75d\powershell_ise.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.15063.0_none_31fb19fd41a13522\ldifde.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_4.0.14917.0_none_d51de7a21e68baae\AddInProcess.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-compact_31bf3856ad364e35_10.0.15063.0_none_aeea78803603d187\compact.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.15063.0_none_1493c1a0fcb41dc8\dpnsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.15063.0_none_e9603dded28cd429\ngen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.15063.0_none_a736a4aecdd85944\driverquery.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.15063.0_none_f310177e01b1811e\tcmsetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.15063.0_none_bffc91b6cd8f1664\UsoClient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.15063.0_none_8adb4d91fb409ef6\TSTheme.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-evntwin_31bf3856ad364e35_10.0.15063.0_none_c7e49d4a3e4ae1de\evntwin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\tsdiscon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_10.0.15063.0_none_47086791d6bf0f2c\FlashPlayerApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.15063.0_none_ca4fb1a61eee0907\SecEdit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.15063.0_none_583904fd3295f809\Dxpserver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.15063.0_none_4daf62e8f16deff5\IMEWDBLD.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-f12chooser_31bf3856ad364e35_11.0.15063.0_none_e1d96673d71865a4\F12Chooser.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.15063.0_none_a587530ec5ca90c1\wlrmdr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\notepad.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.15063.0_none_2898eaeff590ab5c\auditpol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.15063.0_none_6be1a816374e0ec8\BrowserCore.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.15063.0_none_3cc172c3143596cf\printfilterpipelinesvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-wmi-snmp-provider_31bf3856ad364e35_10.0.15063.0_none_5fb0bc3f473106a8\smi2smir.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.15063.0_none_597c2c4f3928aae3\cscript.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-notify_31bf3856ad364e35_10.0.15063.0_none_2e064496e0ce7b34\fvenotify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.15063.0_none_e5cdf8eb1a3747b8\WSManHTTPConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.15063.0_none_4ac90d8b2405715e\dmcertinst.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.15063.0_none_dd7a076377c8505e\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.15063.0_none_bdf655ee7b62cf8c\nfsclnt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rascmak_31bf3856ad364e35_10.0.15063.0_none_21a039cab183985e\rqc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.15063.0_none_a5e91bc2449c5400\SystemPropertiesRemote.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.15063.0_none_ae44660cc960438f\ctfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.15063.0_none_5fb86ae9aae68790\odbcad32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.15063.0_none_425f31447fe3181d\ChtIME.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.15063.0_none_0f14a5b4a7919f86\quickassist.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.15063.0_none_fa622cd33ec493c0\dpnsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.15063.0_none_5225ca891102d259\ctfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.15063.0_none_326d3a42a5473084\lpksetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.15063.0_none_88c9925546b111f8\DsmUserTask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.15063.0_none_a3773526b0c3b2e2\ApproveChildRequest.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.15063.0_none_7dd2b47ab475f1f4\wifitask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.15063.0_none_3fe4b2c9ef33a509\appidtel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.15063.0_none_224b97ad28ee338b\MicrosoftEdgeCP.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.15063.0_none_919981707061e27f\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_32122b5ce7c5dcad\doskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..sktop.appxmain.root_31bf3856ad364e35_10.0.15063.0_none_ec24e4a0e74d86ea\RemindersServer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..embeddedapplauncher_31bf3856ad364e35_10.0.15063.0_none_81e251fae639ed62\EmbeddedAppLauncherConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.15063.0_none_486bf0653ab487af\sdchange.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-media-cap..ternal-broadcastdvr_31bf3856ad364e35_10.0.15063.0_none_d2dd80a2832d80d8\bcastdvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.15063.0_none_a035c9ed427a2051\logagent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.15063.0_none_96cb8ad5c830676e\IMESEARCH.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.15063.0_none_62c5d8cc15957bd9\IEExec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.15063.0_none_6c257c3cb63101f8\rdrleakdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_microsoft.workflow.compiler_31bf3856ad364e35_4.0.14917.0_none_4be216e3bd1423b5\Microsoft.Workflow.Compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.15063.0_none_fea254bb6abb2588\PackagedCWALauncher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.15063.0_none_c0eae57e8ab5f4e1\msdt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_4e2f7735bc0d9e16\HOSTNAME.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.15063.0_none_698655b590af2a70\expand.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.15063.0_none_063fa71d3876cdbb\pcwrun.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.15063.0_none_6bea86693ba8f696\SystemPropertiesPerformance.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.15063.0_none_e661adada9f803d0\ReAgentc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.15063.0_none_a8175f714ea5fe46\ClipUp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-proquota_31bf3856ad364e35_10.0.15063.0_none_dcbc358d12d6701b\proquota.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.15063.0_none_2c51f6502201d2af\iisreset.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.15063.0_none_ca67dc4e5867595b\unsecapp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_c2wtshost_31bf3856ad364e35_10.0.15063.0_none_cf871fb2bbc34e8f\c2wtshost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-wab-app_31bf3856ad364e35_10.0.15063.0_none_f79e9b365803e694\wabmig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.15063.0_none_4e7f7ad6cb1d2087\lsass.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.15063.0_none_3c47ff3e638dd49c\DismHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.15063.0_none_f6b1fa56970a22eb\EhStorAuthn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15552.17062_none_3375b59003a7ec42\CasPol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_eb8784774de6a9ad_iscsicli.exe_20e14d4f e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.15063.0_none_2035e231b67bc3ca\icsunattend.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.15063.0_none_32122b5ce7c5dcad\chcp.com e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.15063.0_none_2b5436ebeae78fa9\wscadminui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.15063.0_none_6fbd7c51467b24ae\Dism.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.15063.0_none_d8c871551f8056f3\DmNotificationBroker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..verycenter-platform_31bf3856ad364e35_10.0.15063.0_none_5452c60eca787254\SystemResetPlatform.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-windowpicker.appxmain_31bf3856ad364e35_10.0.15063.0_none_70b47d552622f3ca\WindowPicker.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.15063.0_none_e5cdf8eb1a3747b8\wsmprovhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-convert_31bf3856ad364e35_10.0.15063.0_none_51ca887128c37c31\autoconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_4.0.14917.0_none_d27cdc4ff8a772bf\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.15063.0_none_b51699c59d97329d\SMConfigInstaller.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\winhlp32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.15063.0_none_bf607555907274a2\sxstrace.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.15063.0_none_3bdf35a17313b74c\wermgr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.15063.0_none_bc1b3f5b642099f1\WinMgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.15063.0_none_0eff3a7dfbd65b7a\CertEnrollCtrl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.15063.0_none_d73c4aa04048b90c\SndVol.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.15063.0_none_18fdca143ee4528f_bridgeunattend.exe_60b7e340 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.15063.0_none_24c43bc2edee9fcb\powercfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_jsc_b03f5f7f11d50a3a_4.0.15552.17062_none_6f731e8beb401478\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-web_config_b03f5f7f11d50a3a_4.0.14917.0_none_e5429a7867061393\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.15063.0_none_4ba01b63d7ffbb2c\IMEPADSV.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.15063.0_none_f7468058d209fb04\isoburn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.15063.0_none_ca67dc4e5867595b\mofcomp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.15063.0_none_f39dd1f571ccd621\memtest.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.15063.0_none_60ff7f9434cd47f8\winload.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.15063.0_none_e75e9f9d0b5ad3c2\mmgaserver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..pdate-oob-component_31bf3856ad364e35_10.0.15063.0_none_feaa67e4dd30b715\rdvgm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.15063.0_none_4e1d229c1329acbe\icacls.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_884a70a7a64329ee\ngentask.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\splwow64.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.15063.0_none_bb5aba0e13c80b21\dasHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.15063.0_none_8624b0496d416293\WinBioDataModelOOBE.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.15063.0_none_6d1d2a9de6ebea22\explorer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.15063.0_none_c10bbabf9ab95ca6\bootcfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.14917.0_none_d74e5def3078f3ec\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bubbles_31bf3856ad364e35_10.0.15063.0_none_7f921f7502c05ae5\Bubbles.scr e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.15063.0_none_4b6c90a3d99e2006\colorcpl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_cc9653c94a544114\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.15063.0_none_5053139043c78d4b\dllhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.15063.0_none_f1b349ef3fbb95bd\mmgaserver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.15063.0_none_46fcd99711ae409d\CloudNotifications.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.15063.0_none_614287fd61f5466c\PasswordOnWakeSettingFlyout.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.15063.0_none_c63b0e06e0c04299\w3wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-secinit_31bf3856ad364e35_10.0.15063.0_none_3cad2e2d4d6f8141\secinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersShareTargetApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-jsc_b03f5f7f11d50a3a_10.0.15063.0_none_f9b02daf974f6d24\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.15063.0_none_45fe693e0f66cb50\dllhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.15063.0_none_be3772f6b91825d9\FXSSVC.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.15063.0_none_b49bde28ded2f8e1\ucsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.15063.0_none_f5a9a21d2c7306c6\NetEvtFwdr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.15063.0_none_0ad609360221e0ad\ie4uinit.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_c53b9c03c7b5d8af\fontdrvhost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-takeown_31bf3856ad364e35_10.0.15063.0_none_aee0a37f960f622d\takeown.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-ppiprojection.appxmain_31bf3856ad364e35_10.0.15063.0_none_17719193ec542ada\Receiver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-datasvcutil_b03f5f7f11d50a3a_4.0.14917.0_none_d51fc6d11dbd7894\DataSvcUtil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.15063.0_none_ab6a05b80807c433\efsui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.15063.0_none_7bfeabd9337d55a1\vdsldr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.15063.0_none_f65a14b7b8293e51\psr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Boot\PCAT\memtest.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.15063.0_none_228a248d8977d11b\ndadmin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.15063.0_none_29d654d1c0932f30\chkntfs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.15063.0_none_ade923f4e120ed67\autoconv.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.15063.0_none_7b0979c965084db5\netsh.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_4.0.14917.0_none_0ee3d0558c8031fd\EdmGen.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_10.0.15063.0_none_0fbbf0c1a5c98e0d\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.15063.0_none_2e97707bc6105930\LegacyNetUXHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_jsc_b03f5f7f11d50a3a_4.0.14917.0_none_633ccca9ba9a046a\jsc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.15063.0_none_ffcbab8c7f62dda5\dsmgmt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-winhstb_31bf3856ad364e35_10.0.15063.0_none_ddfb4c0e89d81a03\winhlp32.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\logoff.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_10.0.15063.0_none_bc60b82f2a33a189\ilasm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.14917.0_none_dd9c436f1d0caefd\mscorsvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\HoloShell\HoloShellApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.15063.0_none_c6cf32da3e1c774d\svchost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_43dacce387acdc1b\ROUTE.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.15063.0_none_e6f9e915b39e102c\TSTheme.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_10.0.15063.0_none_3083d70bbb66fcf1\xpsrchvw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sethc_31bf3856ad364e35_10.0.15063.0_none_17b57caef58c9683\EaseOfAccessDialog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.15063.0_none_69bbb0ec140eb63c\mighost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.15063.0_none_9efebbf70fe05fe0\comrepl.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-syskey_31bf3856ad364e35_10.0.15063.0_none_2976721b5e50d33d\syskey.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-agent-service_31bf3856ad364e35_10.0.15063.0_none_0848baa091119234\snmp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.15063.0_none_fc2457edb4cdc66c\ResetEngine.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.15063.0_none_df90578fbaa4e229\whoami.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.15063.0_none_7d443ad9ecf1cbd0_ntoskrnl.exe_0fb0ab79 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.15063.0_none_08bc44fbe481b23e\vmcompute.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.15063.0_none_685fe984eaf6056e_appidpolicyconverter.exe_83972af0 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.15063.0_none_ffa25c15b3c615ba\dialer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_10.0.15063.0_none_092aa9735899975c\aspnet_regsql.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.15063.0_none_243c0d7e29228ad2\rasdial.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.15063.0_none_af245dab572dabc2\nbtstat.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.15063.0_none_3e098bc8ad9cca4d\OOBENetworkConnectionFlow.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.15063.0_none_3d7f35d3819a20a2\ktmutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.15063.0_none_96f17bfa49540fe8\tcmsetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.15063.0_none_58040d3b25ceb1f0\IMEWDBLD.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..egistration-cmdline_31bf3856ad364e35_10.0.15063.0_none_5048e542483eaa7f\dsregcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_ad1d9764d9c2a978\perfmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_be549efe47bbc296\poqexec.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.15063.0_none_62c8804bb28b2827\explorer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.15063.0_none_574f7bdc0307cfa4\dplaysvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.15063.0_none_37cf9bf85378124e\ComSvcConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.15063.0_none_5610865856ee34af\MDMAgent.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\chgport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.15063.0_none_1d126ff3dac9cbd1\getmac.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.15063.0_none_009279fe31499ac6\sysprep.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.15063.0_none_7dfca982e49cd055\CameraSettingsUIHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.15063.0_none_7b70c48a870a37e2\browserexport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.15063.0_none_ad730875459063eb\mfpmp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..auncher-cmdlinetool_31bf3856ad364e35_10.0.15063.0_none_0853c4529bd43688\pwlauncher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.15063.0_none_9e9d16fe6fbf7681\mtstocom.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.15063.0_none_f44daa69365a638d\PackagedCWALauncher.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.15063.0_none_34d7716b9692b238\dxdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.15063.0_none_2c028519c752071f\dccw.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\query.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.15063.0_none_be146ab6516b9494\wusa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.15063.0_none_2de833670beadc3d\adaminstall.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.15063.0_none_e534a797c60d29ce\msfeedssync.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx4-microsoft.workflow.compiler_b03f5f7f11d50a3a_4.0.14917.0_none_72cb179532097ac4\Microsoft.Workflow.Compiler.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.15063.0_none_b77241b70e236b73\resmon.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-web_config_b03f5f7f11d50a3a_4.0.14917.0_none_2cefd14f7b823c99\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.15063.0_none_6f17d0d7de2b430c\WallpaperHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.15063.0_none_5be5810e34f9fd65\iediagcmd.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.15063.0_none_958fd3aaec6fff19\recdisc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.15063.0_none_4be672cafbfac46e\sessionmsg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.15063.0_none_f54db1c37f6553bf\dialer.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.15063.0_none_a1203527fc912969\IMESEARCH.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..sktop.appxmain.root_31bf3856ad364e35_10.0.15063.0_none_ec24e4a0e74d86ea\SearchUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.15063.0_none_bf1afac017cb8e06\TokenBrokerCookies.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-waitfor_31bf3856ad364e35_10.0.15063.0_none_6b5af396fba4e11a\waitfor.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.15063.0_none_5a2dfd4ab1867e91\AppVClient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.15063.0_none_daf742dc5d6829ca\SystemPropertiesDataExecutionPrevention.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.15063.0_none_7ebbfe6cf207da03\ieUnatt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.15063.0_none_cb7fb450d58a1fb2\verifiergui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.15063.0_none_12e9e9dc43f0e41d\rdpclip.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.15063.0_none_3433b80420218818\XBox.TCUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..itemplayer.appxmain_31bf3856ad364e35_10.0.15063.0_none_321f672489c5b007\HoloItemPlayerApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..tofservice-oposhost_31bf3856ad364e35_10.0.15063.0_none_98355d70770fb20f\OposHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15552.17062_none_18b4461941577a2f\aspnet_regbrowsers.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\InfusedApps\Packages\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.15063.0_none_21fd4bfdeda110b4\iisreset.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.15063.0_none_43405787e61101ff\AuditShD.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-fontview_31bf3856ad364e35_10.0.15063.0_none_f9594af536e84e36\fontview.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_1618b8867f46668a\diskperf.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\PerceptionSimulationDevice.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.15063.0_none_1d2a56435316cddc\bootcfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.15063.0_none_5680c856f72204f6\dpnsvr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.15063.0_none_39a68a4ac47c2e57\RecoveryDrive.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_inspectvhddialog6.3_31bf3856ad364e35_10.0.15063.0_none_d8ecefae57fd58c3\InspectVhdDialog6.3.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.15063.0_none_16ad70084afccb22\PresentationFontCache.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.15063.0_none_4b5c237ee2c228b2\raserver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.15063.0_none_0b529588dc98e2ff\srdelayed.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.14917.0_none_f7511a26fd62be08\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.15063.0_none_4fc9a2eb601f4ab0\GamePanel.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.15063.0_none_1371040ac337bde6\unlodctr.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-setspn_31bf3856ad364e35_10.0.15063.0_none_91197aa316f28be6\setspn.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.15063.0_none_8c65dfda8586112c\RdpSa.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.15063.0_none_c7655775d54792f7\winver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_4.0.14917.0_none_cdc27e81379454bf\SMSvcHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.15063.0_none_0dbf7ea91dc966a4\ApplySettingsTemplateCatalog.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystemminpnp_31bf3856ad364e35_10.0.15063.0_none_1b70ea73251f149e\drvcfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.15063.0_none_bbe663b4ac5f809e\w3wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_10.0.15063.0_none_0123465b1cc2dff5\fveprompt.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.15063.0_none_53bd36ba106157ca\wab.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.15063.0_none_4d62956f29fd17e9\wextract.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.15063.0_none_feaa4aea0c96ae81\Fondue.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.15063.0_none_9315b2ff99920f80\pcaui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-certutil_31bf3856ad364e35_10.0.15063.0_none_6a7a45a2b3cddafe\certutil.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.15063.0_none_16e4792eaed0bc57\ExtExport.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.15063.0_none_c404762d16ccc3b7\SecHealthUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.15063.0_none_45a310d67ef53006\SrTasks.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.15063.0_none_68208ee220d71dc1\LinqWebConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.15552.17062_none_deb32e32294d82cd\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-forfiles_31bf3856ad364e35_10.0.15063.0_none_0a18ad555dfa127c\forfiles.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.15063.0_none_7e39691a28ae6cba\aspnet_wp.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.15063.0_none_2c51f6502201d2af\iissetup.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.15063.0_none_352aa580a48fe452\RmClient.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_web_config_b03f5f7f11d50a3a_10.0.15063.0_none_57692798ba45b713\web.config.comments e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-globalsansserifcf_b03f5f7f11d50a3a_4.0.14917.0_none_36b5c31abffa7756\GlobalSansSerif.CompositeFont e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.15063.0_none_7ba4fd2e9a959f80\dfsvc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.15063.0_none_8b8abdeceb9942a9\NetCfgNotifyObjectHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_4e2f7735bc0d9e16\TCPSVCS.EXE e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.15063.0_none_a24bf27b90d3314e\Netplwiz.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-winver_31bf3856ad364e35_10.0.15063.0_none_6b46bbf21cea21c1\winver.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.15063.0_none_af6b1cb112ce3d3c\LicensingUI.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.15063.0_none_26ceadd5f7d6ab68\runonce.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.15063.0_none_f39dd1f571ccd621_memtest.exe_01d80391 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-mail-app_31bf3856ad364e35_10.0.15063.0_none_a64d6b3dd0267b2d\WinMail.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_35936f5c6ef5b58c\aspnet_regiis.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.15063.0_none_2b207574eda70e50\mcbuilder.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.15063.0_none_b9fd2b5993ed42a4\alg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.15063.0_none_a587530ec5ca90c1\mpnotify.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.15063.0_none_0124423e7e7a6753\dcdiag.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.15063.0_none_0dee440537bd3d4c\ShellExperienceHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.15063.0_none_2142b4f18a48407d\netcfg.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.15063.0_none_e76818d92ebb0454\printui.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.15063.0_none_342aff23f4f3f12b\chkntfs.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.15063.0_none_a9860a305bc1347d\mspaint.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-cloudstoragewizard_31bf3856ad364e35_10.0.15063.0_none_a96302ea0e08f023\CloudStorageWizard.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_10.0.15063.0_none_d064b6dcb1ea0fef\RegAsm.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.15063.0_none_79246cbd5036fdcc\certreq.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.15063.0_none_9f98741fe88ed514\BackgroundTransferHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_4.0.14917.0_none_c446621a9aa3e13c\WsatConfig.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-deployment_31bf3856ad364e35_10.0.15063.0_none_b0e434806dbf4a55\setupugc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.15063.0_none_eac10c4a65cbe913\ApplicationFrameHost.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.15063.0_none_52c09ab76f1549aa\msra.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.15063.0_none_9e5f4352ad06261f\mshta.exe e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3084 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe Token: 33 3084 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe Token: SeIncBasePriorityPrivilege 3084 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe Token: SeIncBasePriorityPrivilege 3592 svchost.exe Token: SeLockMemoryPrivilege 3592 svchost.exe Token: SeLockMemoryPrivilege 3592 svchost.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3084 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3084 wrote to memory of 3592 3084 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe 75 PID 3084 wrote to memory of 3592 3084 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe 75 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe"C:\Users\Admin\AppData\Local\Temp\e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3084 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3592
-