Rezultaty skanu uzupełniającego Farbar Recovery Scan Tool (x64) Wersja: 17-10-2016 Uruchomiony przez Michal (24-10-2016 21:51:44) Uruchomiony z C:\Users\Michal\Desktop\jjjjj Windows 10 Home (X64) (2016-04-16 12:22:24) Tryb startu: Normal ========================================================== ==================== Konta użytkowników: ============================= Administrator (S-1-5-21-3050205260-1417234-1560976378-500 - Administrator - Disabled) Gość (S-1-5-21-3050205260-1417234-1560976378-501 - Limited - Disabled) Konto domyślne (S-1-5-21-3050205260-1417234-1560976378-503 - Limited - Disabled) Michal (S-1-5-21-3050205260-1417234-1560976378-1001 - Administrator - Enabled) => C:\Users\Michal ==================== Centrum zabezpieczeń ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie.) AV: COMODO Antivirus (Enabled - Up to date) {D0CC7563-ABD2-DEBE-138E-FDD553335AF2} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Zainstalowane programy ====================== (W fixlist dozwolone tylko załączanie programów adware z flagą "Hidden" w celu ich uwidocznienia. Programy adware powinny zostać w poprawny sposób odinstalowane.) µTorrent (HKU\S-1-5-21-3050205260-1417234-1560976378-1001\...\uTorrent) (Version: 3.4.7.42330 - BitTorrent Inc.) Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated) AIMP (HKLM-x32\...\AIMP) (Version: v4.02.1713, 27.04.2016 - AIMP DevTeam) ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.4.3 - ASUS) ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 4.0.12 - ASUS) ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 3.13.0004 - ASUS) ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 4.1.6 - ASUS) Asystent uaktualnienia do systemu Windows 10 (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17362 - Microsoft Corporation) ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0040 - ASUS) AudioWizard (HKLM-x32\...\{57E770A2-2BAF-4CAA-BAA3-BD896E2254D3}) (Version: 1.0.0.95 - ICEpower a/s) Battlefield: Bad Company™ 2 (HKLM-x32\...\{3AC8457C-0385-4BEA-A959-E095F05D6D67}) (Version: 1.0.0.0 - Electronic Arts) CCleaner (HKLM\...\CCleaner) (Version: 5.23 - Piriform) COMODO Antivirus (HKLM\...\{84875F6F-2996-4469-BF1D-F59A85C5C702}) (Version: 8.2.0.5005 - COMODO Security Solutions Inc.) Counter Strike 1.6 FINAL PrO ENG (2014) (HKU\S-1-5-21-3050205260-1417234-1560976378-1001\...\Counter Strike 1.6 FINAL PrO ENG (2014)) (Version: - ) Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version: - Valve) Device Setup (HKLM-x32\...\{8D6B05E0-F457-408C-9D13-549334D8FAE1}) (Version: 2.0.2 - ASUSTek Computer Inc.) Dropbox 25 GB (HKLM-x32\...\{597A58EC-42D6-4940-8739-FB94491B013C}) (Version: 1.0.8.0 - Dropbox, Inc.) Euro Truck Simulator 2 (HKLM-x32\...\{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1) (Version: 1.0.5 - SCS Software) FormatFactory 3.8.0.0 (HKLM-x32\...\FormatFactory) (Version: 3.8.0.0 - Free Time) Gaming Assistant (HKLM-x32\...\{C27B0A7C-BD18-46EF-984A-CCD2799F4CD4}) (Version: 1.0.2 - ASUS) GIMP 2.8.18 (HKLM\...\GIMP-2_is1) (Version: 2.8.18 - The GIMP Team) Google Update Helper (x32 Version: 1.3.21.169 - Google Inc.) Hidden gpedt.msc 1.0 (HKLM-x32\...\{10B9C608-BF7C-4CCF-A658-C01D969DCA21}_is1) (Version: - Richard) HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version: - EFD Software) Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1018 - Intel Corporation) Intel(R) Chipset Device Software (x32 Version: 10.1.1.7 - Intel(R) Corporation) Hidden Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.1.10603.192 - Intel Corporation) Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1162 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.15.4268 - Intel Corporation) Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation) Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4693.1005 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) MiniTool Partition Wizard Free 9.1 (HKLM\...\{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1) (Version: - MiniTool Solution Ltd.) Mozilla Firefox 45.0.2 (x64 pl) (HKLM\...\Mozilla Firefox 45.0.2 (x64 pl)) (Version: 45.0.2 - Mozilla) Mozilla Firefox 49.0.2 (x86 pl) (HKLM-x32\...\Mozilla Firefox 49.0.2 (x86 pl)) (Version: 49.0.2 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 49.0.2.6136 - Mozilla) NVIDIA Graphics Driver 353.84 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 353.84 - NVIDIA Corporation) NVIDIA PhysX System Software 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation) Pakiet sterowników systemu Windows - ASUS (ATP) Mouse (11/11/2015 1.0.0.262) (HKLM\...\A044C5901003C24E6891688653ABA1068D04A1A0) (Version: 11/11/2015 1.0.0.262 - ASUS) Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 10.0.1.2 - Qualcomm Atheros) Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros) Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.31222 - Realtek Semiconduct Corp.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.2.703.2015 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7746 - Realtek Semiconductor Corp.) Speccy (HKLM\...\Speccy) (Version: 1.29 - Piriform) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden UpdateAssistant (x32 Version: 1.2.0.0 - Microsoft Corporation) Hidden WebStorage (HKLM-x32\...\WebStorage) (Version: 2.2.2.524 - ASUS Cloud Corporation) WildTangent Games App (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-asus) (Version: 4.0.11.16 - WildTangent) WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 3.0.1 - ASUS) WinRAR 5.31 (64-bitowy) (HKLM\...\WinRAR archiver) (Version: 5.31.0 - win.rar GmbH) Wise Game Booster 1.37 (HKLM-x32\...\Wise Game Booster_is1) (Version: 1.37 - WiseCleaner.com, Inc.) ==================== Niestandardowe rejestracje CLSID (filtrowane): ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) CustomCLSID: HKU\S-1-5-21-3050205260-1417234-1560976378-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Michal\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileCoAuth.exe (Microsoft Corporation) ==================== Zaplanowane zadania (filtrowane) ============= (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) Task: {02E82CA1-F4DF-4D8E-9C2A-326C7079FC2B} - System32\Tasks\ATK Package A22126881260 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2015-03-10] (ASUSTek Computer Inc.) Task: {046D1502-D088-42E6-AA8E-C3968ABB36AF} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-30] (COMODO) Task: {1E24BFE9-013F-4CF6-AF00-1827EA179C51} - System32\Tasks\Driver Booster SkipUAC (Michal) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe Task: {3644AFA5-C701-47B3-9CAF-F674B4793A96} - System32\Tasks\ASUS Live Update1 => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2016-09-02] () Task: {38A42289-872A-43FC-B5DA-4BA086998CB7} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2015-05-25] (ASUSTek Computer Inc.) Task: {3F6E048D-6404-433B-8F5F-CFF4D89BF89E} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => Rundll32.exe generaltel.dll,RunTelemetryW Task: {3FC71125-C701-45FB-AF26-DD12333CC0FB} - System32\Tasks\{7E273C52-F66A-444B-A97A-57F1D6C9AF17} => pcalua.exe -a "C:\Program Files (x86)\AOMEI Partition Assistant Pro Edition 5.2\unins000.exe" Task: {407F0C8B-F909-49D7-99BD-E21A4A5533F7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: {58D77F74-DCBE-4CA1-BD17-5303466C2CBD} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-30] (COMODO) Task: {654AF52F-132C-4686-B651-B9E86F5B994E} - System32\Tasks\WiseCleaner\WGBSkipUAC => C:\Program Files (x86)\Wise\Wise Game Booster\WiseGameBooster.exe [2016-06-07] (WiseCleaner.com) Task: {6AC13BB8-AB93-48C0-BD34-C187E64843A0} - System32\Tasks\Update Checker => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2016-09-02] () Task: {6B1582CF-7502-478F-8EE5-E087282649DB} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2016-05-19] (AsusTek) Task: {76A3E34D-62C3-41D9-8F94-FCB4D562D04C} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2016-09-29] (COMODO) Task: {7D809FCA-05C6-4882-9F07-CF8B41190346} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-30] (COMODO) Task: {8860A5BE-D63F-4090-82E2-86EBDE7D1871} - System32\Tasks\DropboxOEM => C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe [2015-05-29] () Task: {99785CAE-6BAA-4F7A-82AA-58BC3E8842E4} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Michal\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe [2016-10-22] (Microsoft Corporation) Task: {9B0AF97A-BC64-4C91-BA70-033ED7F96748} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2015-08-25] (ASUS) Task: {ACB5BA2E-0A35-4E06-AD40-86CA6C6965DF} - System32\Tasks\RtHDVBg_ListenToDevice => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2016-06-07] (Realtek Semiconductor) Task: {AF7E7051-3CE0-41A5-B41C-4932AF0F5638} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2015-05-14] (ASUSTek Computer Inc.) Task: {B842BD4E-FCBB-4E9E-BD52-696A3348D8F7} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2016-06-07] (Realtek Semiconductor) Task: {B94352E6-4FF0-401A-8C59-7B6CAC20E61A} - System32\Tasks\Microsoft\Office\Microsoft Office Touchless Attach Notification => C:\Program Files (x86)\Microsoft Office\Office15\FirstRun.exe [2015-03-14] (Microsoft Corporation) Task: {C6222F05-049B-4F71-9855-BE0C1DC8AE30} - System32\Tasks\ASUS Live Update2 => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2016-09-02] () Task: {D15A751B-7EB4-41F5-8E66-3AC169544A3F} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant => C:\Windows\UpdateAssistant\UpdateAssistant.exe [2016-10-01] (Microsoft Corporation) Task: {D947B821-3463-4FB3-A942-97261E9AC00C} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-10-22] (Piriform Ltd) Task: {E729627C-E6C6-409C-9B7D-23E1C6C1850C} - System32\Tasks\ATK Package 36D18D69AFC3 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2015-03-10] (ASUSTek Computer Inc.) Task: {EAA46FC7-CC0D-4932-A4BE-AFA8474A67D5} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-30] (COMODO) Task: {F9D4A91A-9662-41C8-BA46-86D3CE1933E7} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2016-09-29] (COMODO) (Załączenie wejścia w fixlist spowoduje przesunięcie pliku zadania (.job). Plik uruchamiany docelowo przez zadanie nie zostanie przeniesiony.) ==================== Skróty ============================= (Wybrane wejścia mogą zostać załączone w celu ich zresetowania lub usunięcia.) ==================== Załadowane moduły (filtrowane) ============== 2015-08-15 07:27 - 2015-07-15 04:04 - 00032768 _____ () C:\Windows\SYSTEM32\licensemanagerapi.dll 2015-09-23 12:12 - 2015-08-07 19:18 - 00116528 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2016-09-15 19:58 - 2016-09-15 19:58 - 00404480 _____ () C:\Windows\System32\diagtrack_wininternal.dll 2016-10-13 21:27 - 2016-10-13 21:27 - 02495776 _____ () C:\Windows\system32\CoreUIComponents.dll 2016-10-13 21:27 - 2016-10-13 21:27 - 02495776 _____ () C:\Windows\System32\CoreUIComponents.dll 2016-10-22 14:09 - 2016-10-22 14:09 - 01864384 _____ () C:\Users\Michal\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\ClientTelemetry.dll 2015-08-28 11:04 - 2015-08-13 15:42 - 00415656 _____ () C:\Windows\system32\igfxTray.exe 2016-04-16 19:25 - 2016-04-16 19:25 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll 2015-07-10 12:59 - 2015-07-10 12:59 - 00143360 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\XamlTileRendering.dll 2016-03-16 11:25 - 2016-03-16 11:25 - 00073912 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav 2016-09-15 19:57 - 2016-09-15 19:57 - 06569472 _____ () C:\windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll 2016-09-15 19:57 - 2016-09-15 19:57 - 00471040 _____ () C:\windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2016-09-15 20:00 - 2016-09-15 20:00 - 01808384 _____ () C:\windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll 2016-04-16 19:27 - 2016-04-16 19:27 - 02274816 _____ () C:\windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll 2015-08-25 10:40 - 2015-08-25 10:40 - 00027648 _____ () C:\Program Files (x86)\ASUS\Splendid\DetectDisplayDC.dll 2015-08-25 10:40 - 2015-08-25 10:40 - 00124928 _____ () C:\Program Files (x86)\ASUS\Splendid\CCTAdjust.dll 2015-09-23 12:12 - 2015-07-24 06:22 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll 2015-08-07 02:09 - 2015-08-07 02:09 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll 2013-04-27 10:24 - 2013-04-27 10:24 - 00071680 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\checkmetro.dll ==================== Alternate Data Streams (filtrowane) ========= (Załączenie wejścia w fixlist spowoduje usunięcie strumienia ADS.) AlternateDataStreams: C:\Windows\explorer.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\RtCRU64.exe:$CmdTcID [130] AlternateDataStreams: C:\Windows\unins000.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\aadcloudap.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\aadtb.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\accountaccessor.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\aclui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\acmigration.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AcpiServiceVnA64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ActiveSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\adhsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\adsmsext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\advapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\aeinv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\aepic.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AERTAC64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AERTAR64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\aitstatic.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\APHostService.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\apisetschema.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\apphelp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ApplicationFrame.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AppointmentApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\appraiser.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AppReadiness.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\apprepapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\apprepsync.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\appwiz.cpl:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AppxAllUserStore.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\AppXApplicabilityBlob.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AppxApplicabilityEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AppXDeploymentClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AppXDeploymentExtensions.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AppXDeploymentServer.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AppxPackaging.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AppxSip.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AppxSysprep.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ASGCoInstaller_x64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\asycfilt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\atmfd.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\atmlib.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\audiodg.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AudioEndpointBuilder.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AudioEng.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AUDIOKSE.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\audioLibVc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AudioSes.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\audiosrv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AuthBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\authfwcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AuthHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\authui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\AzureSettingSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\basesrv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\bcdedit.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\BCP47Langs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\bcryptprimitives.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\BFE.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\BingMaps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\bisrv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\blackbox.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\browcli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\browser.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\browserbroker.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\browser_broker.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\BthRadioMedia.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\cabinet.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CallHistoryClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\catsrvut.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CellularAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\cemapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\certca.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\certcli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CertEnroll.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\certmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\certprop.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Chakra.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Chakradiag.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\ChatApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CheckNetIsolation.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ci.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\cic.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\Clipc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ClipSVC.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ClipUp.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\cloudAP.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CloudDomainJoinDataModelServer.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\clusapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\cmdl32.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\cmintegrator.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\cmipnpinstall.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\COLORCNV.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\combase.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\comdlg32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CompatTelRunner.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\comsvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CONEQMSAPOGUILibrary.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\configmanager2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\configurationclient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ContactApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ContentDeliveryManager.Utilities.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CoreMessaging.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CoreUIComponents.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CPFilters.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CredProvDataModel.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\credprovhost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\credprovs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\crypt32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CryptoWinRT.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\cryptsvc.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\cryptui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\csrsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\CX64APO.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d2d1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3d10level9.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3d10warp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3d11.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3d9.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DCompiler_33.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DCompiler_34.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DCompiler_35.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DCompiler_36.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DCompiler_37.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DCompiler_38.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DCompiler_39.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DCompiler_40.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DCompiler_41.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DCompiler_42.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DCompiler_43.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\D3DCompiler_47.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dcsx_42.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dcsx_43.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\d3dx10.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx10_33.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx10_34.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx10_35.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx10_36.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx10_37.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx10_38.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx10_39.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx10_40.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx10_41.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx10_42.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx10_43.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\d3dx11_42.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx11_43.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\d3dx9_24.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_25.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_26.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_27.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_28.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_29.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_30.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_31.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_33.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_34.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_35.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\d3dx9_36.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DX9_37.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DX9_38.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DX9_39.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\D3DX9_40.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DX9_41.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DX9_42.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\D3DX9_43.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\DafPrintProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dafWCN.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DAMediaManager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DAMM.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DaOtpCredentialProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\das.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DataSenseHandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dbgcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dbgeng.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DbgModel.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dcomp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DDPA64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DDPA64F3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DDPD64A.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\DDPD64AF3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DDPO64A.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DDPO64AF3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DDPP64A.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DDPP64AF3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\devenum.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\deviceaccess.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\deviceassociation.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DeviceEnroller.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DevicePairing.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\devinv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\devmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\diagperf.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\diagtrack.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\diagtrack_win.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\diagtrack_wininternal.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\directmanipulation.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Display.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dlnashext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dmcertinst.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dmcsps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dmdskmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dmenrollengine.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DMRServer.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DolbyDAX2APOProp.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\DolbyDAX2APOv201.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\DolbyDAX2APOv211.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\domgmt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dosvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dot3gpui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dot3mm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dot3ui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\drvstore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dssvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSBassEnhancementDLL64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSBoostDLL64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSGainCompensatorDLL64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSGFXAPO64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSGFXAPONS64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSLFXAPO64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSLimiterDLL64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSNeoPCDLL64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSS2HeadphoneDLL64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSS2SpeakerDLL64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSSymmetryDLL64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSU2PGFX64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSU2PLFX64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSU2PREC64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DTSVoiceClarityDLL64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dui70.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\duser.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dwmcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dwmredir.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\DWrite.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dxgi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\dxtrans.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\eapp3hst.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\eappcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\eappgnui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\eapphost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\eappprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\eapsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\easwrt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\edgehtml.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\EditionUpgradeHelper.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\EditionUpgradeManagerObj.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\EDPCleanup.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\efswrt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\els.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\EmailApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\EncDec.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\enrollmentapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\EnterpriseAppMgmtSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\enterprisecsps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\EnterpriseDesktopAppMgmtCSP.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\EnterpriseModernAppMgmtCSP.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\esent.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\EthernetMediaManager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\evr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ExecModelClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\expand.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ExplorerFrame.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ExSMime.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\extrac32.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ExtrasXmlParser.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\f3ahvoas.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\facecredentialprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\fdWCN.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\fhcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\fhengine.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\fhsettingsprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\filemgmt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\FirewallAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\FMAPO64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\FntCache.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\fontdrvhost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\FontProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\fphc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\fveapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\fwbase.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\fwcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\fwpolicyiomgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\FWPUCLNT.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\FwRemoteSvr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\GamePanel.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\gameux.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\gdi32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\GdiPlus.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\generaltel.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Geolocation.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\GlobCollationHost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\gpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\gpsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\HarmanAudioInterface.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\hevcdecoder.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\hgcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\HiFiDAX2API.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\hlink.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\HMAPO.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\HMClariFi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\HMEQ.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\HMEQ_Voice.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\HMHVS.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\HMLimiter.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\HMUI.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\hnetcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\httpprxm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\httpprxp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\HttpsDataSource.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\iassvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ICEsoundAPO64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\icsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\IdCtrls.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ie4uinit.exe:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\ieapfltr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\iedkcs32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ieframe.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ieproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\iertutil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ieui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\IKEEXT.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ImplatSetup.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\inetcomm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\inetcpl.cpl:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\inetpp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\InputService.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\InstallAgent.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\IntelSSTAPO.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\IntelSstCApoPropPage.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\internetmail.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\invagent.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\IoTAssignedAccessLockFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\iphlpsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ipsecsnp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\IPSECSVC.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\JpMapControl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\jscript.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\jscript9.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\jscript9diag.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\KAAPORT64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\KBDAZE.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\KBDAZEL.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\KBDAZST.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\kbdgeoqw.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\kerberos.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\kernel32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\KernelBase.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\KeywordDetectorMsftSidAdapter.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\KnobsCore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\KnobsCsp.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\ksproxy.ax:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LegacyNetUX.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LegacyNetUXHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LicenseManager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LicenseManagerShellext.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\licensingdiag.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\localspl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LocationApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LocationCrowdsource.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LocationFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LocationFrameworkInternalPS.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LocationGeofences.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\LocationPeCell.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LocationPeIP.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LocationPermissions.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LocationPeWiFi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LocationWebproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LocationWiFiAdapter.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LockAppBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LockAppHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\LogonController.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\lsasrv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\lsass.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Magnification.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Magnify.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\makecab.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MapConfiguration.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MapControlCore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MapsStore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxAudioAPO20.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxAudioAPO30.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxAudioAPO4064.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxAudioAPO5064.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxAudioAPO6064.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxAudioAPO7064.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxAudioAPOShell64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxAudioEQ64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxAudioRealtek64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxSpeechAPO64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxVoiceAPO2064.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxVoiceAPO3064.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxVoiceAPO4064.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MaxxVolumeSDAPO.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MbaeApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MbaeApiPublic.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MbaeParserTask.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MBMediaManager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mbsmsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MCRecvSrc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mcupdate_GenuineIntel.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MDEServer.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MDMAppInstaller.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mdmmigrator.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mdmregistration.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MessagingDataModel2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mf.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfasfsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MFCaptureEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfds.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfh264enc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MFMediaEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfmp4srcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfnetcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfnetsrc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfplat.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfpmp.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfsvr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mftranscode.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mfvdsp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MFWMAAEC.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\microsoft-windows-system-events.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MiracastReceiver.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mispace.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MISS_APO.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mmc.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mmcbase.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mmcndmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mmcshext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\modernexecserver.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mos.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\moshost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MosHostClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\moshostcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MP3DMOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MP43DECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MP4SDECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MPG4DECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mprddm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mprdim.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MPSSVC.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mqrt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MrmCoreR.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MrmIndexer.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\MRT.exe:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\MSAJApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mscms.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\msctf.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msctfuimanager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msdtc.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msdtckrm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msdtctm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msfeeds.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msftedit.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mshtml.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mshtmled.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msmpeg2adec.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MSMPEG2ENC.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msmpeg2vdec.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msnetobj.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msscntrs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msscp.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\MsSpellCheckingFacility.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mssph.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mssphtb.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mssprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mssrch.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mssvp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mstsc.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mstscax.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msv1_0.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msvcp120.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msvcp_win.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msvcr120.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MSVidCtl.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\mswsock.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msxml3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\msxml6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mtxoci.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MusNotification.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\MusUpdateHandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\mycomput.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NAHIMICAPOlfx.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NahimicAPONSControl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NAHIMICV2apo.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NAHIMICV3apo.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NaturalLanguage6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ncryptprov.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ncryptsslp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ncsi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ndfapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\netapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\netcenter.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NetCfgNotifyObjectHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\netcfgx.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\netman.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NetSetupApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NetSetupEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NetSetupShim.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NetSetupSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\nettrace.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NetworkBindingEngineMigPlugin.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NetworkCollectionAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NetworkDesktopSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NetworkMobileSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NetworkUXBroker.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ngccredprov.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ngckeyenum.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ngcsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ninput.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\nlasvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\nlmgp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NotificationController.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\NotificationObjFactory.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\nshwfp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ntdll.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ntoskrnl.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ntprint.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ntshrui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\odbcconf.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\oemlicense.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\offreg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ole32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\oleacc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\oleacchooks.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\oleaut32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\omadmapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\omadmclient.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\OnDemandConnRouteHelper.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\OneBackupHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\OneDriveSettingSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\OpcServices.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\PackageStateRoaming.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\pcasvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\PhoneCallHistoryApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\PimIndexMaintenance.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\PimIndexMaintenanceClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Pimstore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\pku2u.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\PlayToManager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\PlayToReceiver.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\pnidui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\pnpclean.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\policymanager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\polstore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\POSyncServices.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\PresentationHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\PresentationHostProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\printfilterpipelinesvc.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\prm0015.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\profext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\profsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\propsys.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\provcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\provdatastore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\provengine.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\provhandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\provisioningcsp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\provops.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ProvPluginEng.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\provtool.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ProximityService.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\PsmServiceExtHost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\psmsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\puiapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\puiobj.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\pwdrvio.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\pwdspio.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\pwNative.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\pwrshplugin.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\qdvd.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\qedit.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\quartz.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\R4EEA64A.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\R4EED64A.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\R4EEG64A.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\R4EEL64A.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\R4EEP64A.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rasapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rasgcw.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rasman.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rasmans.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RasMediaManager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RCoInstII64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rdbui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rdpcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rdpcorets.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rdpinput.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rdpudd.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rdvidcrl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RDXService.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RDXTaskFactory.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ReAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RecoveryDrive.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ReInfo.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\remoteaudioendpoint.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\RemoteNaturalLanguage.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RESAMPLEDMO.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\reseteng.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\resutils.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RltkAPO64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RMActivate.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RMActivate_isv.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RMActivate_ssp.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RMActivate_ssp_isv.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RP3DAA64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RP3DHT64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rpcrt4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rpcss.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\rsaenh.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RTCOM64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RtCRX64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RtDataProc64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RTEED64A.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\RTEEG64A.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RTEEL64A.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RTEEP64A.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RtkApi64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RtkCfg64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RtkCoLDR64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RtlCPAPI64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RTMediaFrame.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RtNicProp64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RtPgEx64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\RTSnMg64.cpl:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\samlib.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\samsrv.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\scapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SCardDlg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\schannel.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\schedsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sdengin2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sdrsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sdshext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SEAPO64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Search.ProtocolHandler.MAPI2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SearchFolder.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SearchIndexer.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SearchProtocolHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SecConfig.efi:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\seclogon.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SECOMN64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\secproc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\secproc_isv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SEHDRA64.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\SensorDataService.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SensorsApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SettingMonitor.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SettingsHandlers_Notifications.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SettingsHandlers_nt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SettingsHandlers_StorageSense.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SettingSync.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SettingSyncCore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SettingSyncHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\setupapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SFAPO64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SFCOM64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SFNHK64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SFSS_APO.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\shacct.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\SharedStartModel.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SharedStartModelShim.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ShareHost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sharemediacpl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SHCore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\shell32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\shutdownux.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SIHClient.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sl3apo64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\slcnt64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\slprp64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sltech64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SmartcardCredentialProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SmiEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SmsRouterSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\spcompat.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SpeechPal.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\spoolsv.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sppcext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sppobjs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sppsvc.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sppwinob.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sqmapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SRAPO64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SRCOM.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SRCOM64.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\SRH.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SRHInproc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SRRPTR64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SRSHP64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SRSTSH64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SRSTSX64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SRSWOW64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\srvcli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sspicli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SSShim.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\StikyNot.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\storagewmi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\StoreAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\storewuauth.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\StructuredQuery.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SubscriptionMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sxs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SyncCenter.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\syncmlhook.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\syncutil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\sysmain.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SystemEventsBrokerServer.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SystemSettings.Handlers.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SystemSettings.UserAccountsHandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SystemSettingsAdminFlows.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\SystemSettingsThresholdAdminFlowUI.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tadefxapo.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tadefxapo264.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\taskcomp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\taskeng.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Taskmgr.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\taskschd.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tbauth.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tcpmon.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tdh.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tepeqapo64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tetheringclient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tetheringservice.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\TextInputFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\themecpl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tileobjserver.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\TokenBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\TokenBrokerCookies.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tosade.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tosasfapo64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\toseaeapo64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tossaeapo64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tossaemaxapo64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\TpmTasks.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tpmvsc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tquery.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\tsmf.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\TSWorkspace.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\twinapi.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\twinapi.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\twinui.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\twinui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ucrtbase.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\udhisapi.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\uDWM.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\UIAutomationCore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\UIRibbon.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\UIRibbonRes.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\unimdm.tsp:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Unistore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\updatehandlers.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\upnpcont.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\upnphost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\urlmon.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\user32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\usercpl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\UserDataAccountApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\UserDataLanguageUtil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\UserDataPlatformHelperUtil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\UserDataService.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\UserDataTimeUtil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\UserDataTypeHelperUtil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\userenv.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\UserLanguagesCpl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\usermgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\usermgrcli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\UserMgrProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\usocore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\UXInit.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\uxtheme.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Vault.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\vaultcli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\vaultsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\vbscript.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\VCardParser.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\vds.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\vdsutil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\VEEventDispatcher.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\verifiergui.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\VEStoreEventHandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\VIDRESZR.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\vssapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\vsstrace.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\VSSVC.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\vss_ps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WalletService.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WavesGUILib64.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wbengine.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wbiosrvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wcmcsp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wcmsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WcnApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WcnNetsh.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\wcnwiz.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WdfCoInstaller01011.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WebcamUi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\webcheck.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\webservices.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wer.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\werconcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wermgr.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\werui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wevtsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wfapigp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wfdprov.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wiarpc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wifinetworkmanager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wifiprofilessettinghandler.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\win32kbase.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\win32kfull.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\win32spl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winbici.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winbrand.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.AccountsControl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.ApplicationModel.LockScreen.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.ApplicationModel.Store.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.ApplicationModel.Wallet.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Cortana.Desktop.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Data.Pdf.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Devices.Bluetooth.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Devices.Enumeration.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Devices.Midi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Devices.Picker.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Devices.PointOfService.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Devices.Scanners.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Devices.SmartCards.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Devices.Usb.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\Windows.Devices.WiFiDirect.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Gaming.Preview.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\Windows.Gaming.XboxLive.Storage.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Globalization.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Graphics.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Internal.Bluetooth.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Internal.Management.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Internal.Shell.Broker.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Media.Audio.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Media.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Media.Speech.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Media.Streaming.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Networking.BackgroundTransfer.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Networking.Connectivity.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Networking.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Networking.HostName.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Networking.UX.EapRequestHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Networking.Vpn.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Security.Authentication.OnlineId.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Security.Authentication.Web.Core.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Shell.Search.UriHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Speech.Pal.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.StateRepository.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.StateRepositoryBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.StateRepositoryClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Storage.ApplicationData.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\windows.storage.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Storage.Search.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\Windows.UI.BioFeedback.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.UI.BlockedShutdown.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.UI.Cred.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.UI.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.UI.Immersive.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.UI.Logon.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.UI.PicturePassword.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.UI.Search.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.UI.Shell.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.UI.Xaml.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.UI.Xaml.Phone.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Web.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Windows.Web.Http.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WindowsCodecs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WindowsCodecsExt.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\WindowsCodecsRaw.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winhttp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wininet.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wininit.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winipcfile.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winipcsecproc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winload.efi:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winload.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winlogon.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winmde.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winmsipc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winresume.efi:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winresume.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WinSAT.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winsku.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\winspool.drv:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\winsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WinTypes.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wkscli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wlanapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WLanConn.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wlangpui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WlanMediaManager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WlanMM.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wlanmsm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wlansec.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wlansvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wlanui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wldp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wlidcli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wlidprov.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wlidsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMADMOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMADMOE.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMALFXGFXDSP.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMASF.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wmdrmdev.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wmdrmsdk.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMNetMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wmp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMPDMC.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WmpDui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wmpdxm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wmpeffects.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMPhoto.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wmploc.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wmpmde.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wmpps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wmpshell.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMSPDMOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMSPDMOE.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMVCORE.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMVDECOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMVENCOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMVSDECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMVSENCD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WMVXENCD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\workfolderssvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Wpc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wpccpl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WpcMon.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WpcWebSync.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wpnapps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wpncore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wpninprc.dll:$CmdTcID [32] AlternateDataStreams: C:\Windows\system32\wpnprv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wpr.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WPTaskScheduler.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wpx.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ws2_32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WSClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WsmAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WsmAuto.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wsmprovhost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WsmSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WsmWmiPl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wsp_fs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wsp_health.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wsqmcons.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WSService.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WSShared.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WSSync.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wuapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wuaueng.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wuautoappupdate.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WUDFPlatform.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WUDFx.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WUDFx02000.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wudriver.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wups.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wups2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wusa.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wuuhext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WwaApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WWAHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\WWanAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wwancfg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wwanconn.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wwanmm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\wwansvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\x3daudio1_0.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\x3daudio1_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\X3DAudio1_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\X3DAudio1_3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\X3DAudio1_4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\X3DAudio1_5.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\X3DAudio1_6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\X3DAudio1_7.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine2_0.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine2_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine2_10.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine2_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine2_3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine2_4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine2_5.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine2_6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine2_7.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine2_8.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine2_9.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine3_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine3_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine3_3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine3_4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine3_5.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine3_6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xactengine3_7.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\XAPOFX1_0.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAPOFX1_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAPOFX1_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAPOFX1_3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAPOFX1_4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAPOFX1_5.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\XAudio2_0.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAudio2_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAudio2_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAudio2_3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAudio2_4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAudio2_5.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAudio2_6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XAudio2_7.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\XblAuthManager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XboxNetApiSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xinput1_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xinput1_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xinput1_3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XpsDocumentTargetPrint.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XpsFilt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\XpsPrint.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xpsrchvw.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\xpsservices.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\YamahaAE.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\YamahaAE2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\ztrace_maps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\aclui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\adsmsext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\advapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\apphelp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\appmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\AppointmentApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\apprepapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\apprepsync.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\appwiz.cpl:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\AppxAllUserStore.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\AppXDeploymentClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\AppxPackaging.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\AppxSip.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\asycfilt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\atmfd.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\atmlib.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\AUDIOKSE.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\AudioSes.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\AuthBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\authfwcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\authui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\azroleui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\AzureSettingSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\BCP47Langs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\bcryptprimitives.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\BingMaps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\blackbox.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\browcli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\cabinet.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\CallHistoryClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\catsrvut.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\cemapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\certca.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\certcli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\CertEnroll.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\certmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Chakra.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Chakradiag.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ChatApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\CheckNetIsolation.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\cic.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Clipc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\clusapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\cmdl32.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\cmipnpinstall.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\COLORCNV.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\combase.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\comdlg32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\comsvcs.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\ContactApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\CoreMessaging.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\CoreUIComponents.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\CPFilters.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\CredProvDataModel.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\credprovhost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\credprovs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\crypt32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\CryptoWinRT.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\cryptui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d2d1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3d10level9.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3d10warp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3d11.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3d9.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_33.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_34.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_35.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_36.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_37.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_38.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_39.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_40.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_41.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_42.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_43.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_47.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dcsx_42.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dcsx_43.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_33.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_34.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_35.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_36.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_37.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_38.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_39.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_40.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_41.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_42.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_43.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx11_42.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx11_43.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_24.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_25.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_26.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_27.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_28.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_29.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_30.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_31.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_33.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_34.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_35.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_36.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_37.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_38.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_39.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_40.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_41.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_42.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_43.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\DafPrintProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\DaOtpCredentialProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\dbgcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\dbgeng.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\DbgModel.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\dcomp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\devenum.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\deviceaccess.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\deviceassociation.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\DevicePairing.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\devmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\directmanipulation.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Display.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\dlnashext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\dmdskmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\dot3gpui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\dot3ui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\drmmgrtn.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\drvstore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\dui70.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\duser.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\dwmcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\DWrite.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\dxgi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\dxtrans.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\eapp3hst.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\eappcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\eappgnui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\eapphost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\eappprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\easwrt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\edgehtml.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\efswrt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\els.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\EmailApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\EncDec.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\esent.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\esif_uf.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\evr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ExecModelClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\expand.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\explorer.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ExplorerFrame.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ExSMime.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\extrac32.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ExtrasXmlParser.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\fde.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\fdeploy.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\fdWCN.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\filemgmt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\FirewallAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\FlashPlayerApp.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\fontdrvhost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\fwbase.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\fwcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\fwpolicyiomgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\FWPUCLNT.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\FwRemoteSvr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\GamePanel.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\gameux.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\gdi32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\GdiPlus.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Geolocation.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\GlobCollationHost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\gpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\gpedit.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\gptext.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\hevcdecoder.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\hgcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\hlink.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\hnetcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\iassvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\IdCtrls.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ieapfltr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\iedkcs32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ieframe.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ieproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\iertutil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ieui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\inetcomm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\inetcpl.cpl:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\InputService.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\IoTAssignedAccessLockFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ipsecsnp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ipsmsnap.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\JpMapControl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\jscript.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\jscript9.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\KBDAZE.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\KBDAZEL.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\KBDAZST.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\kbdgeoqw.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\kerberos.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\kernel32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\KernelBase.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ksproxy.ax:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\LicenseManager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\licensingdiag.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\LocationApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\LockAppBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\LockAppHost.exe:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\LogonController.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Magnification.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Magnify.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\makecab.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MapConfiguration.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MapControlCore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MbaeApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MbaeApiPublic.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mbsmsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MCRecvSrc.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\mdmregistration.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\MessagingDataModel2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mf.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfasfsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MFCaptureEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfds.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfh264enc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MFMediaEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfmp4srcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfnetcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfnetsrc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfplat.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfpmp.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfsvr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mftranscode.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mfvdsp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MFWMAAEC.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mispace.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mmc.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mmcbase.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mmcndmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mmcshext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mos.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MosHostClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MP3DMOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MP43DECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MP4SDECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MPG4DECD.DLL:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\mprddm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mprdim.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mqrt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MrmCoreR.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MSAJApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mscms.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msctf.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msctfuimanager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msfeeds.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msftedit.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mshtml.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mshtmled.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msmpeg2adec.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MSMPEG2ENC.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msmpeg2vdec.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msnetobj.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msorcl32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msscntrs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msscp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MsSpellCheckingFacility.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mssph.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mssphtb.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mssrch.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\mssvp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mstsc.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mstscax.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msv1_0.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msvcp_win.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\MSVidCtl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mswsock.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msxml3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\msxml6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mtxoci.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\mycomput.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\NAPCRYPT.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\NaturalLanguage6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ncryptprov.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ncryptsslp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ndfapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\netapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\netcenter.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\netcfgx.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\NetSetupApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\NetSetupEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\NetSetupShim.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\NetworkCollectionAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ninput.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\nlmgp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\NotificationObjFactory.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\nshwfp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ntdll.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ntprint.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ntshrui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\odbcconf.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\oemlicense.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\offreg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ole32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\oleacc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\oleacchooks.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\oleaut32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\olepro32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\OnDemandConnRouteHelper.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\OneDriveSettingSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\OpcServices.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\PackageStateRoaming.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\PhoneCallHistoryApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\PimIndexMaintenanceClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Pimstore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\pku2u.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\PlayToManager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\policymanager.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\polstore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\POSyncServices.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\PresentationHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\PresentationHostProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\PrintConfig.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\profext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\propsys.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\provcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\puiapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\puiobj.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\pwrshplugin.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\qdvd.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\qedit.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\quartz.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\rasapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\rasgcw.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\rasman.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\rdpcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\rdvidcrl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ReAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ReInfo.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\remoteaudioendpoint.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\RemoteNaturalLanguage.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\RESAMPLEDMO.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\resutils.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\RltkAPO.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\RMActivate.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\RMActivate_isv.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\RMActivate_ssp.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\rpcrt4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\rsaenh.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\RsCRIcon.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\RTMediaFrame.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\samlib.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SCardDlg.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\schannel.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Search.ProtocolHandler.MAPI2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SearchFilterHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SearchFolder.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SearchIndexer.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SearchProtocolHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SECOMN32.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\secproc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\secproc_isv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SensorsApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SettingMonitor.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SettingSync.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SettingSyncCore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SettingSyncHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\setupapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SFCOM.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\shacct.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ShareHost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SHCore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\shell32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SmartcardCredentialProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\sppcext.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\sqmapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SRCOM.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SRH.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SRHInproc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\srvcli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\sspicli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SSShim.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\storagewmi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\StructuredQuery.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\sxs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\SyncCenter.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\taskcomp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\taskeng.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Taskmgr.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\taskschd.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\tbauth.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\tdh.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\tetheringclient.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\TextInputFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\themecpl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\TokenBroker.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\TokenBrokerCookies.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\tquery.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\tsmf.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\twinapi.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\twinapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\twinui.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\twinui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ucrtbase.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\udhisapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\UIAutomationCore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\UIRibbon.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\UIRibbonRes.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\unimdm.tsp:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Unistore.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\upnpcont.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\upnphost.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\urlmon.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\usbceip.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\user32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\usercpl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\UserDataAccountApis.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\UserDataLanguageUtil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\UserDataPlatformHelperUtil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\UserDataTimeUtil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\UserDataTypeHelperUtil.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\userenv.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\UserLanguagesCpl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\usermgrcli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\UserMgrProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\usoapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\UXInit.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\uxtheme.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Vault.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\vaultcli.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\vbscript.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\VCardParser.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\VEEventDispatcher.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\verifiergui.exe:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\VIDRESZR.DLL:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\vssapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\vsstrace.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\WcnApi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wcnwiz.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WebcamUi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\webcheck.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\webservices.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wer.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wermgr.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\werui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wfapigp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wfdprov.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wiaaut.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wimgapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\winbrand.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.AccountsControl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.ApplicationModel.LockScreen.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Data.Pdf.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Bluetooth.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Enumeration.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Midi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Picker.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Scanners.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.SmartCards.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Usb.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.WiFiDirect.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Gaming.Preview.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Globalization.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Graphics.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Internal.Bluetooth.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Internal.Management.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Media.Audio.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Media.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Media.Speech.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Media.Streaming.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Networking.Connectivity.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Networking.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Networking.HostName.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Security.Authentication.OnlineId.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Security.Authentication.Web.Core.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Shell.Search.UriHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Speech.Pal.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.StateRepository.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.StateRepositoryBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.StateRepositoryClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Storage.ApplicationData.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\windows.storage.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Storage.Search.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.BioFeedback.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.BlockedShutdown.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.Cred.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.Immersive.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.Logon.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.Search.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.Xaml.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.Xaml.Phone.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Web.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Windows.Web.Http.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WindowsCodecs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WindowsCodecsExt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WindowsCodecsRaw.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\winhttp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wininet.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\winipcfile.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\winipcsecproc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\winmde.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\winmsipc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\winsku.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\winspool.drv:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WinTypes.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wkscli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wlanapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WLanConn.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wlangpui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WlanMM.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wlanmsm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wlansec.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wlanui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wldp.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wlidcli.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wlidprov.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMADMOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMADMOE.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMASF.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wmdrmdev.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wmdrmsdk.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMNetMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wmp.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\WMPDMC.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WmpDui.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wmpdxm.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wmpeffects.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMPhoto.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wmploc.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wmpshell.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMSPDMOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMSPDMOE.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMVCORE.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMVDECOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMVENCOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMVSDECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMVSENCD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WMVXENCD.DLL:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\Wpc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wpnapps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ws2_32.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WSClient.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WsmAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WsmAuto.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wsmprovhost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WsmSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WsmWmiPl.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wsp_fs.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wsp_health.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WSShared.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WSSync.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wuapi.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\wudriver.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WWAHost.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\WWanAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\x3daudio1_0.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\x3daudio1_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_3.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_5.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_7.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_0.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_10.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_5.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_7.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_8.dll:$CmdTcID [130] AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_9.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_0.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_5.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_7.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_0.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_5.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_0.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_4.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_5.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_6.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_7.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xinput1_1.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xinput1_2.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xinput1_3.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XpsDocumentTargetPrint.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XpsFilt.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\XpsPrint.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xpsrchvw.exe:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\xpsservices.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\SysWOW64\ztrace_maps.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\afd.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\ahcache.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\AsHIDSwitch64.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\AsusTP.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\athw10x.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\bridge.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\BthAvrcpTg.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\BthLEEnum.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\bthport.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\buttonconverter.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\cng.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\dfsc.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\dptf_cpu.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\dtlitescsibus.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\dtliteusbbus.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\dxgkrnl.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\dxgmms1.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\dxgmms2.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\esif_lf.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\fastfat.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\fvevol.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\FWPKCLNT.SYS:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\genericusbfn.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\gpuenergydrv.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\hdaudbus.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\HdAudio.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\http.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\IntcDAud.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\ksecdd.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\ksecpkg.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\mrxdav.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb10.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb20.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\ndis.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\netbt.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\netio.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\ntfs.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\nwifi.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\pci.sys:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\Drivers\pdc.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\portcls.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\rasl2tp.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\rmcast.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\rt640x64.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\RTKVHD64.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\RtsUer.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\scfilter.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\sdbus.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\serial.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\Smb_driver_Intel.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\srv.sys:$CmdTcID [130] AlternateDataStreams: C:\Windows\system32\Drivers\srv2.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\srvnet.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\ssudbus.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\ssudmdm.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\stornvme.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\storport.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\tcpip.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\tdx.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\TeeDriverW8x64.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\tm.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\usb8023.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\usbhub.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\USBHUB3.SYS:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\usbser.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\USBSTOR.SYS:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\USBXHCI.SYS:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\vhdmp.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\Wdf01000.sys:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\WdfCoInstaller01011.dll:$CmdTcID [64] AlternateDataStreams: C:\Windows\system32\Drivers\WdiWiFi.sys:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Desktop\adwcleaner_5.119.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Desktop\adwcleaner_5.119.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Desktop\maxresdefault.jpg:$CmdZnID [32] AlternateDataStreams: C:\Users\Michal\Desktop\maxresdefault11.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Desktop\xd.dem:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\1 HOUR _ Hard Trap Music Mix _ Best of Trap.mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\1 HOUR _ Hard Trap Music Mix _ Best of Trap.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\AdwCleaner(1).exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\AdwCleaner(1).exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\AdwCleaner.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\AdwCleaner.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Almadia.pl.rar:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Almadia.pl.rar:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Behmer - John Cena.mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Behmer - John Cena.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Best of EDM 2016 _ 69 Party Bangers in 69 min _ Electro House Music Remix _ New Club Mix.mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Best of EDM 2016 _ 69 Party Bangers in 69 min _ Electro House Music Remix _ New Club Mix.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\ccsetup523.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\ccsetup523.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Chipset_Intel_Win7_64_VER9441006.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Chipset_Intel_Win7_64_VER9441006.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Counter-Strike 1.6 WH.rar:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Counter-Strike 1.6 WH.rar:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\CS-cheats.7z:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\CS-cheats.7z:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Cypis - Nie spaćZwiedzaćZapierdalać.mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Cypis - Nie spaćZwiedzaćZapierdalać.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Down In The DM DJ Flex (Jersey Club Remix) Extended Version.mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Down In The DM DJ Flex (Jersey Club Remix) Extended Version.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\DTLiteInstaller.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\DTLiteInstaller_www.INSTALKI.pl.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\EasyUEFI_Free.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\EasyUEFI_Free.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Folder2Iso_3.1_www.INSTALKI.pl.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Folder2Iso_3.1_www.INSTALKI.pl.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\gimp-2.8.18-setup.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\gimp-2.8.18-setup.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\gpedit_msc_add.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\gpedit_msc_add.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\HLC23.exe:$CmdTcID [130] AlternateDataStreams: C:\Users\Michal\Downloads\HLC23.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1608271553-de_dust2-1472305980-1472307180.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1608271553-de_dust2-1472305980-1472307180.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1608271613-de_train-1472307180-1472308440.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1608271613-de_train-1472307180-1472308440.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1609111321-de_dust-1473592860-1473594060.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1609111321-de_dust-1473592860-1473594060.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1609111341-de_kabul32-1473594060-1473595320.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1609111341-de_kabul32-1473594060-1473595320.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1609131857-de_dust2002-1473785820-1473787020.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1609131857-de_dust2002-1473785820-1473787020.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1610091204-de_westwood-1476007440-1476008640.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\hltv-1610091204-de_westwood-1476007440-1476008640.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\ISORecorder31x64.msi:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\ISORecorder31x64.msi:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\KęKę - Nic już nie muszę prod. Kubi Producent.mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\KęKę - Nic już nie muszę prod. Kubi Producent.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\New Best Club Dance Summer House Music Mashups Remixes Mix 2016 - CLUB MUSIC.mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\New Best Club Dance Summer House Music Mashups Remixes Mix 2016 - CLUB MUSIC.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\New Best Club Party Dance Music Remixes Mashups Mix 2016 - PDB.mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\New Best Club Party Dance Music Remixes Mashups Mix 2016 - PDB.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\O.S.T.R. - Spowiedź feat. Sacha Vee - prod. Killing Skills.mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\O.S.T.R. - Spowiedź feat. Sacha Vee - prod. Killing Skills.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\OSTRY (Bezimienni) x Paluch x Alan Walker - Pierwszy raz (Tecek Blend)[VIDEO].mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\OSTRY (Bezimienni) x Paluch x Alan Walker - Pierwszy raz (Tecek Blend)[VIDEO].mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\PAssist_Std.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\PAssist_Std.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Pop Charts Mix 2016 Best Remixes Of Popular Songs 2015 _ New Dance Hits Top 100 _ EDM Party Music.mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Pop Charts Mix 2016 Best Remixes Of Popular Songs 2015 _ New Dance Hits Top 100 _ EDM Party Music.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Psyko Punkz ft Massive New Krew - Ninja (Official Videoclip).mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Psyko Punkz ft Massive New Krew - Ninja (Official Videoclip).mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\pwfree91.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\pwfree91.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\QBIK - Mam Wyjebane.mp3:$CmdTcID [130] AlternateDataStreams: C:\Users\Michal\Downloads\QBIK - Mam Wyjebane.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Rihanna & Drake - Work [Emma & Shaun Cover] (Koni Remix).mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Rihanna & Drake - Work [Emma & Shaun Cover] (Koni Remix).mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\rufus-1.4.9.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\rufus-1.4.9.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Setup.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Setup.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Silverlight_x64.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Silverlight_x64.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Sitek - Chcemy Być Wyżej.mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Sitek - Chcemy Być Wyżej.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\SteamSetup.exe.cavtmp0:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\USB3_Intel_Win7_64_VER30019.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\USB3_Intel_Win7_64_VER30019.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\Wallhack_1.0_Nonsteam.rar:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\Wallhack_1.0_Nonsteam.rar:$CmdZnID [26] AlternateDataStreams: C:\Users\Michal\Downloads\WGBSetup.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\WLAN_Atheros_Win7_64_VER1000285.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Michal\Downloads\WLAN_Atheros_Win7_64_VER1000285.zip:$CmdZnID [26] ==================== Tryb awaryjny (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Wartość "AlternateShell" zostanie przywrócona.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="" ==================== Powiązania plików (filtrowane) =============== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci.) ==================== Internet Explorer - Witryny zaufane i z ograniczeniami =============== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru.) ==================== Hosts - zawartość: =============================== (Użycie dyrektywy Hosts: w fixlist spowoduje reset pliku Hosts.) 2015-07-10 13:04 - 2015-07-10 13:02 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Inne obszary ============================ (Obecnie brak automatycznej naprawy dla tej sekcji.) HKU\S-1-5-21-3050205260-1417234-1560976378-1001\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\theme1\img1.jpg DNS Servers: 192.168.100.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Zapora systemu Windows [funkcja włączona] ==================== MSCONFIG/TASK MANAGER - Wyłączone elementy == HKLM\...\StartupApproved\Run32: => "WebStorage" HKU\S-1-5-21-3050205260-1417234-1560976378-1001\...\StartupApproved\Run: => "OneDrive" HKU\S-1-5-21-3050205260-1417234-1560976378-1001\...\StartupApproved\Run: => "CCleaner Monitoring" HKU\S-1-5-21-3050205260-1417234-1560976378-1001\...\StartupApproved\Run: => "uTorrent" HKU\S-1-5-21-3050205260-1417234-1560976378-1001\...\StartupApproved\Run: => "Steam" ==================== Reguły Zapory systemu Windows (filtrowane) =============== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{BD90B2CB-CBB9-403D-8A34-E8908D79FC91}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{FE2A2D05-43C2-48C3-BC05-6C0D8327F415}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{A5EF432A-3325-41E3-B089-17518B031C9B}] => (Allow) C:\Users\Michal\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{123B13CD-AC44-409F-8072-23732CB81615}] => (Allow) C:\Users\Michal\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{9218AA41-371A-4791-BA1E-558058D7814C}] => (Allow) C:\Users\Michal\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{5881BC0A-2F04-416A-85CD-2DB8A0983989}] => (Allow) C:\Users\Michal\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{97E9D7A8-8B1F-4D90-B25B-7144E6ACB683}] => (Allow) C:\Users\Michal\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{664C1010-D528-499D-B4D6-7A8A1B3B3A85}] => (Allow) C:\Users\Michal\AppData\Roaming\uTorrent\uTorrent.exe FirewallRules: [{E3F847F9-F6AA-4193-88A0-CE61EA204934}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{8B3B06F1-A91B-4301-AE01-FC7E85B5D4DE}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{EE356E25-EFAF-4733-9F9E-3EE78CC7A6E8}] => (Allow) C:\Program Files (x86)\FormatFactory\FormatFactory.exe FirewallRules: [{CFE86867-ACE8-429B-BE22-2D36ADE0DF0B}] => (Allow) C:\Program Files (x86)\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe FirewallRules: [{B0D92C91-1EA2-43C2-AB11-832BAF86DAF8}] => (Allow) C:\Program Files (x86)\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe FirewallRules: [{954ACF32-40C1-4EFA-9F2C-ED793540117D}] => (Allow) C:\Program Files (x86)\FormatFactory\FormatFactory.exe FirewallRules: [{18E506BD-C1BC-492C-AC38-E485E1998187}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{76CA3589-4DCE-4773-AD73-C2C71DFA885A}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{BF0C6982-F30D-4477-8978-6F636E858A58}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe FirewallRules: [{8F144EA7-6BA8-48DB-BF7B-7AEFF5852AED}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe FirewallRules: [TCP Query User{650C30AC-5F76-47D7-8748-5DA326C2540D}C:\program files (x86)\asus\splendid\acmon.exe] => (Block) C:\program files (x86)\asus\splendid\acmon.exe FirewallRules: [UDP Query User{6F6AA6E6-147C-4518-A374-3ED7F9F16C5C}C:\program files (x86)\asus\splendid\acmon.exe] => (Block) C:\program files (x86)\asus\splendid\acmon.exe FirewallRules: [TCP Query User{D187135B-2469-4095-A89A-9721F321DCDC}C:\program files (x86)\microsoft office\office15\firstrun.exe] => (Block) C:\program files (x86)\microsoft office\office15\firstrun.exe FirewallRules: [UDP Query User{21AFAFA4-47B2-400B-B8EE-19F866B1233A}C:\program files (x86)\microsoft office\office15\firstrun.exe] => (Block) C:\program files (x86)\microsoft office\office15\firstrun.exe FirewallRules: [TCP Query User{1A623284-3406-49A8-B390-B655BFBF5B74}C:\program files (x86)\nvidia corporation\update core\nvbackend.exe] => (Block) C:\program files (x86)\nvidia corporation\update core\nvbackend.exe FirewallRules: [UDP Query User{21D383BB-0006-40B9-8FD6-D0E14B80BB5F}C:\program files (x86)\nvidia corporation\update core\nvbackend.exe] => (Block) C:\program files (x86)\nvidia corporation\update core\nvbackend.exe FirewallRules: [TCP Query User{3BFEC1D8-FBAD-450A-9672-DFCB933B7670}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [UDP Query User{3DA40C35-1056-495B-9F9A-2DCEB79CF976}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [TCP Query User{8A46F3D6-9DAC-428F-BADD-A6891EDE95E9}C:\program files (x86)\aimp\aimp.exe] => (Block) C:\program files (x86)\aimp\aimp.exe FirewallRules: [UDP Query User{C699504C-66E9-4A81-9A61-6E9B4855A292}C:\program files (x86)\aimp\aimp.exe] => (Block) C:\program files (x86)\aimp\aimp.exe FirewallRules: [TCP Query User{33C4BA65-DB98-4175-A71E-4445C56193B7}D:\cs1.6\hl.exe] => (Allow) D:\cs1.6\hl.exe FirewallRules: [UDP Query User{8F5CA322-4B4C-41ED-BEDB-413BDD14935B}D:\cs1.6\hl.exe] => (Allow) D:\cs1.6\hl.exe ==================== Punkty Przywracania systemu ========================= ==================== Wadliwe urządzenia w Menedżerze urządzeń ============= ==================== Błędy w Dzienniku zdarzeń: ========================= Dziennik Aplikacja: ================== Error: (10/24/2016 09:42:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-AG3OM08) Description: Aktywacja aplikacji Microsoft.Windows.Photos_8wekyb3d8bbwe!App nie powiodła się. Błąd: -2144927141. Więcej informacji można znaleźć w dzienniku Microsoft-Windows-TWinUI/Działa. Error: (10/24/2016 09:42:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-AG3OM08) Description: Aktywacja aplikacji Microsoft.Windows.Photos_8wekyb3d8bbwe!App nie powiodła się. Błąd: -2144927142. Więcej informacji można znaleźć w dzienniku Microsoft-Windows-TWinUI/Działa. Error: (10/24/2016 09:42:26 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Program Microsoft.Photos.exe w wersji 1.0.1607.22006 przestał współpracować z systemem Windows i został zamknięty. Aby sprawdzić, czy jest dostępnych więcej informacji na temat tego problemu, sprawdź historię problemu w oknie Zabezpieczenia i konserwacja w Panelu sterowania. Identyfikator procesu: 18c4 Godzina rozpoczęcia: 01d22e2ea6d4d1de Godzina zakończenia: 4294967295 Ścieżka aplikacji: C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.722.10060.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe Identyfikator raportu: f0532c4a-9a21-11e6-9c39-f832e43bf35d Pełna nazwa pakietu powodującego błąd: Microsoft.Windows.Photos_16.722.10060.0_x64__8wekyb3d8bbwe Identyfikator aplikacji względem pakietu powodującego błąd: App Error: (10/24/2016 09:42:01 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: DESKTOP-AG3OM08) Description: Aplikacja Microsoft.Windows.Photos_16.722.10060.0_x64__8wekyb3d8bbwe+App nie została uruchomiona w wyznaczonym czasie. Error: (10/24/2016 08:44:55 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-AG3OM08) Description: Aktywacja aplikacji Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI nie powiodła się. Błąd: -2144927141. Więcej informacji można znaleźć w dzienniku Microsoft-Windows-TWinUI/Działa. Error: (10/24/2016 07:29:41 PM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to add firewall exception for C:\Program Files (x86)\Steam\bin\steamwebhelper.exe Error: (10/24/2016 05:31:35 PM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to add firewall exception for C:\Program Files (x86)\Steam\bin\steamwebhelper.exe Error: (10/23/2016 07:51:20 PM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to add firewall exception for C:\Program Files (x86)\Steam\bin\steamwebhelper.exe Error: (10/22/2016 08:10:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-AG3OM08) Description: Aktywacja aplikacji Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI nie powiodła się. Błąd: -2144927141. Więcej informacji można znaleźć w dzienniku Microsoft-Windows-TWinUI/Działa. Error: (10/22/2016 07:11:53 PM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to add firewall exception for C:\Program Files (x86)\Steam\bin\steamwebhelper.exe Dziennik System: ============= Error: (10/24/2016 09:44:26 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AG3OM08) Description: Serwer App nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (10/24/2016 09:42:26 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AG3OM08) Description: Serwer App.AppXy9rh3t8m2jfpvhhxp6y2ksgeq77vymbq.mca nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (10/24/2016 08:44:55 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AG3OM08) Description: Serwer CortanaUI.AppXd4tad4d57t4wtdbnnmb8v2xtzym8c1n8.mca nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (10/24/2016 08:44:54 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Usługa Synchronizuj hosta_Session2 niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 10000 milisekund zostanie podjęta następująca czynność korekcyjna: Uruchom usługę ponownie. Error: (10/23/2016 09:43:05 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Usługa Synchronizuj hosta_Session1 niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 10000 milisekund zostanie podjęta następująca czynność korekcyjna: Uruchom usługę ponownie. Error: (10/23/2016 10:46:21 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Usługa Synchronizuj hosta_Session2 niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 10000 milisekund zostanie podjęta następująca czynność korekcyjna: Uruchom usługę ponownie. Error: (10/22/2016 08:10:41 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AG3OM08) Description: Serwer CortanaUI.AppXd4tad4d57t4wtdbnnmb8v2xtzym8c1n8.mca nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (10/22/2016 08:10:38 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Usługa Synchronizuj hosta_Session1 niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 10000 milisekund zostanie podjęta następująca czynność korekcyjna: Uruchom usługę ponownie. Error: (10/22/2016 02:20:14 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-AG3OM08) Description: Serwer CortanaUI.AppXd4tad4d57t4wtdbnnmb8v2xtzym8c1n8.mca nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (10/22/2016 02:20:13 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Usługa Synchronizuj hosta_Session1 niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 10000 milisekund zostanie podjęta następująca czynność korekcyjna: Uruchom usługę ponownie. CodeIntegrity: =================================== Date: 2016-10-24 21:49:10.663 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-24 21:28:11.294 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-24 21:18:12.710 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-23 19:51:22.745 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-22 16:11:09.614 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-22 14:34:43.606 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-22 14:04:44.500 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-22 13:47:13.189 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-22 11:24:19.885 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-22 10:26:58.543 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. ==================== Statystyki pamięci =========================== Procesor: Intel(R) Core(TM) i3-4005U CPU @ 1.70GHz Procent pamięci w użyciu: 42% Całkowita pamięć fizyczna: 4001.47 MB Dostępna pamięć fizyczna: 2314.14 MB Całkowita pamięć wirtualna: 4705.47 MB Dostępna pamięć wirtualna: 2337.62 MB ==================== Dyski ================================ Drive c: (OS) (Fixed) (Total:371.85 GB) (Free:294.94 GB) NTFS ==>[system z komponentami startowymi (pozyskano odczytując dysk)] Drive d: (DATA) (Fixed) (Total:282.43 GB) (Free:181.19 GB) NTFS Drive f: (SIEDEM) (Fixed) (Total:237.41 GB) (Free:195.91 GB) NTFS ==================== MBR & Tablica partycji ================== ======================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: 991037B2) Partition: GPT. ==================== Koniec Addition.txt ============================