Résultats de l'Analyse supplémentaire de Farbar Recovery Scan Tool (x64) Version:07-02-2016 Exécuté par phil (2016-02-14 20:13:16) Exécuté depuis C:\Users\phil\Desktop Windows 8.1 (X64) (2014-04-04 15:58:44) Mode d'amorçage: Normal ========================================================== ==================== Comptes: ============================= Administrateur (S-1-5-21-1829065414-1029609543-2641321589-500 - Administrator - Disabled) Invité (S-1-5-21-1829065414-1029609543-2641321589-501 - Limited - Disabled) phil (S-1-5-21-1829065414-1029609543-2641321589-1001 - Administrator - Enabled) => C:\Users\phil ==================== Centre de sécurité ======================== (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé.) AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Comodo Defense+ (Enabled - Up to date) {493CE176-EB84-BC8D-9707-B3ACF7598648} AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: COMODO Firewall (Enabled) {CA6681B7-87D1-B25B-86E8-21EB720D8B8E} ==================== Programmes installés ====================== (Seuls les logiciels publicitaires ('adware') avec la marque 'caché' ('Hidden') sont susceptibles d'être ajoutés au fichier fixlist.txt pour qu'ils ne soient plus masqués. Les programmes publicitaires devront être désinstallés manuellement.) 64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden 7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov) Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.286 - Adobe Systems Incorporated) Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG) AVG PC TuneUp (HKLM-x32\...\AVG PC TuneUp) (Version: 16.3.1.24857 - AVG Technologies) AVG PC TuneUp (x32 Version: 16.3.3 - AVG Technologies) Hidden Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.15.129 - Avira Operations GmbH & Co. KG) Avira Launcher (HKLM-x32\...\{ccdc9cfe-8ba7-4c6c-ac5f-b2d6cfa49efc}) (Version: 1.1.54.24924 - Avira Operations GmbH & Co. KG) Avira Launcher (x32 Version: 1.1.54.24924 - Avira Operations GmbH & Co. KG) Hidden BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden Camtasia Studio 8 (HKLM-x32\...\{A2A41B60-D51F-4C04-BC94-B4C94F7B6DC0}) (Version: 8.6.0.2054 - TechSmith Corporation) CCleaner (HKLM\...\CCleaner) (Version: 5.07 - Piriform) COMODO Firewall (HKLM\...\{38F898C8-272F-455F-9BD6-71FEBA3E4AF5}) (Version: 8.2.0.4703 - COMODO Security Solutions Inc.) D2300 (x32 Version: 140.0.421.000 - Hewlett-Packard) Hidden D2300_Help (x32 Version: 82.0.233.000 - Hewlett-Packard) Hidden DeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden DriversCloud.com (64 bits) (HKLM\...\{8A6F0F58-AE48-4F4C-A06F-C391AB17069C}) (Version: 8.0.2.1 - Cybelsoft) FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version: - FileHippo.com) FileZilla Client 3.11.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.11.0.2 - Tim Kosse) FlashGet3.7 (HKLM-x32\...\FlashGet3.7) (Version: 3.7.0.1203 - hxxp://www.FlashGet.com) FMW 1 (Version: 1.22.2 - AVG Technologies) Hidden Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 2.3.25.1124 - Foxit Software Inc.) Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.0.8.1216 - Foxit Software Inc.) FXCM MetaTrader 4 (HKLM-x32\...\FXCM MetaTrader 4) (Version: 4.00 - MetaQuotes Software Corp.) GPBaseService2 (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP) HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP) HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP) HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard) HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden HPProductAssistant (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden HPSSupply (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.9.0.1001 - Intel Corporation) Java 8 Update 73 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218073F0}) (Version: 8.0.730.2 - Oracle Corporation) LibreOffice 5.0.2.2 (HKLM-x32\...\{71508AE2-346A-4E56-AE95-DBB8DE692258}) (Version: 5.0.2.2 - The Document Foundation) MarketResearch (x32 Version: 140.0.299.000 - Hewlett-Packard) Hidden Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Mises à jour NVIDIA 2.5.15.54 (Version: 2.5.15.54 - NVIDIA Corporation) Hidden Mozilla Firefox 44.0.1 (x86 fr) (HKLM-x32\...\Mozilla Firefox 44.0.1 (x86 fr)) (Version: 44.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 44.0.1.5879 - Mozilla) Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.8.3 - Notepad++ Team) NVIDIA GeForce Experience 2.5.15.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.5.15.54 - NVIDIA Corporation) NVIDIA Logiciel système PhysX 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation) NVIDIA Pilote 3D Vision 358.91 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 358.91 - NVIDIA Corporation) NVIDIA Pilote audio HD : 1.3.34.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.4 - NVIDIA Corporation) NVIDIA Pilote du contrôleur 3D Vision 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation) NVIDIA Pilote graphique 358.91 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 358.91 - NVIDIA Corporation) NVIDIA Son virtuel Miracast 358.91 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Miracast.VirtualAudio) (Version: 358.91 - NVIDIA Corporation) OpenOffice 4.1.1 (HKLM-x32\...\{121727D5-FDF3-4723-BA57-EB383440ED72}) (Version: 4.11.9775 - Apache Software Foundation) Panneau de configuration NVIDIA 358.91 (Version: 358.91 - NVIDIA Corporation) Hidden Photosmart and Deskjet Drivers 14.0 Rel. A (HKLM\...\{F58E1340-3FD5-40B8-A07C-4893CFC29749}) (Version: 14.0 - HP) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7076 - Realtek Semiconductor Corp.) REALTEK Wireless LAN Driver (HKLM-x32\...\{B63CCD1C-A133-4DF8-8306-DA0387231152}) (Version: 1.00.0201.2 - REALTEK Semiconductor Corp.) SF_CDA_ProductContext (x32 Version: 140.0.421.000 - Hewlett-Packard) Hidden SF_CDA_Software (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden SHIELD Streaming (Version: 4.1.500 - NVIDIA Corporation) Hidden SHIELD Wireless Controller Driver (Version: 2.5.15.54 - NVIDIA Corporation) Hidden Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP) Skype™ 7.17 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.17.105 - Skype Technologies S.A.) SolutionCenter (x32 Version: 140.0.299.000 - Hewlett-Packard) Hidden Status (x32 Version: 140.0.342.000 - Hewlett-Packard) Hidden Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) Hidden TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb) Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies) Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.) VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN) VMware Workstation (HKLM\...\{132E3257-14F1-411A-BC6C-0CA32D3A9BC6}) (Version: 12.0.0 - VMware, Inc.) VSO ConvertXToDVD (HKLM-x32\...\{CE1F93C0-4353-4C9D-84DA-AB4E7C63ED32}_is1) (Version: 5.1.0.2 - VSO Software) VueScan x64 (HKLM\...\VueScan x64) (Version: - ) WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden ZHPFix 2015 (HKLM-x32\...\ZHPFix_is1) (Version: 2015 - Nicolas Coolman) ==================== Personnalisé CLSID (Avec liste blanche): ========================== (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.) ==================== Tâches planifiées (Avec liste blanche) ============= (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.) Task: {19B80374-BEE8-4FBF-A7C5-BED3D4EA9CA2} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\AVG\AVG PC TuneUp\OneClick.exe [2015-10-23] (AVG Technologies CZ, s.r.o.) Task: {3BDAC264-08F2-4C2F-8F90-8A52E0A24C9E} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2016-01-14] (Microsoft Corporation) Task: {4AAC17CA-7A90-400B-BC1A-F16AA6AAE920} - System32\Tasks\camatasia\recorder camastasia => E:\pour enregistrer camastudio\planificateur tache\Recordercamastudio.bat [2015-08-26] () Task: {4B10EBB7-4447-4F01-B34A-563D8C01F869} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-08-05] (COMODO) Task: {531FF067-A733-4CE9-8872-13F6D61FCB0F} - System32\Tasks\camatasia\eteindre pc => shutdown Task: {56050B25-3269-4A52-9C8E-0C086E264005} - \Programme de mise à jour en ligne de HP. -> Pas de fichier <==== ATTENTION Task: {76948350-5ED1-4E6D-8503-3C25DB8C61BE} - System32\Tasks\camatasia\arret connection => E:\pour enregistrer camastudio\planificateur tache\arret connection .bat [2015-08-26] () Task: {970EF1CD-B070-4B10-9162-6C537F03BDDC} - System32\Tasks\camatasia\stop camastasia => E:\pour enregistrer camastudio\planificateur tache\stopcamastudio.bat [2015-08-26] () Task: {99182A36-E58D-49C9-A60A-0467D37284E3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_ERROR_HB => C:\Windows\system32\MRT.exe [2016-01-14] (Microsoft Corporation) Task: {BA799E10-B95B-41AD-A922-3A33C2C6C9FD} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-05] (COMODO) Task: {BC39F7E0-3920-4ABE-B00B-0E23FCDD0381} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-20] (Piriform Ltd) Task: {D8A2B780-0122-4DBA-87FF-8650C885AEA9} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-05] (COMODO) Task: {FF5E10D0-CE5C-4730-BF1E-96AA2F0C2381} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2016-02-09] (Oracle Corporation) (Si un élément est inclus dans le fichier fixlist.txt, le fichier tâche (.job) sera déplacé. Le fichier exécuté par la tâche ne sera pas déplacé.) ==================== Raccourcis ============================= (Les éléments sont susceptibles d'être inscrits dans le fichier fixlist.txt afin d'être supprimés ou restaurés.) ==================== Modules chargés (Avec liste blanche) ============== 2010-07-15 05:44 - 2010-07-15 05:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll 2015-04-15 21:13 - 2015-04-15 21:13 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll 2015-10-20 17:54 - 2015-11-05 18:13 - 00013088 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll ==================== Alternate Data Streams (Avec liste blanche) ========= (Si un élément est inclus dans le fichier fixlist.txt, seul le flux de données additionnel (ADS - Alternate Data Stream) sera supprimé.) AlternateDataStreams: C:\Windows\explorer.exe:$CmdTcID AlternateDataStreams: C:\Windows\HelpPane.exe:$CmdTcID AlternateDataStreams: C:\Windows\hh.exe:$CmdTcID AlternateDataStreams: C:\Windows\notepad.exe:$CmdTcID AlternateDataStreams: C:\Windows\regedit.exe:$CmdTcID AlternateDataStreams: C:\Windows\splwow64.exe:$CmdTcID AlternateDataStreams: C:\Windows\twain_32.dll:$CmdTcID AlternateDataStreams: C:\Windows\winhlp32.exe:$CmdTcID AlternateDataStreams: C:\Windows\write.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\accessibilitycpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\acledit.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\aclui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\acppage.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\acproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ActionCenter.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ActionCenterCPL.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ActionQueue.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\activeds.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\actxprxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\adhapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\adhsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\adprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\adsldp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\adsldpc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\adsmsext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\adsnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\adtschema.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\advapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\advpack.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\aecache.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\aelupsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AepRoam.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\aitagent.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\aitstatic.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\alg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\AltTab.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\amstream.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\apds.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\apphelp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Apphlpdm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\appidapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\appidcertstorecheck.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\appidpolicyconverter.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\appidsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\appinfo.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AppReadiness.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\apprepapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\apprepsync.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\appsruprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\appwiz.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\AppxAllUserStore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AppxApplicabilityEngine.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AppXDeploymentClient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AppXDeploymentExtensions.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AppXDeploymentServer.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AppxPackaging.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AppxSip.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AppxStreamingDataSourcePS.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AppxSysprep.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ARP.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\aspnet_counters.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\asycfilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\at.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\AtBroker.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\atl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\atlthunk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\attrib.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\audiodg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\AudioEndpointBuilder.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AudioEng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AUDIOKSE.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AudioSes.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\audiosrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\auditcse.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\auditpol.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\AuthBroker.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AuthExt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\authfwcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AuthFWGP.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AuthFWSnapin.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AuthFWWizFwk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AuthHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\AuthHostProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\authui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\authz.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\autochk.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\autoconv.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\autofmt.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\autoplay.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AutoWorkplaceN.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\avicap32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\avifil32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\avrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AxInstSv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AxInstUI.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\azroles.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\azroleui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AzSqlExt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\backgroundTaskHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\BackgroundTransferHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\basecsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\basesrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\batmeter.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bcd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bcdboot.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\bcdedit.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\bcdprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bcdsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\BCP47Langs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bcrypt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bcryptprimitives.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bdaplgin.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\BdeHdCfgLib.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bderepair.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bdesvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bdeui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\BdeUISrv.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\bdeunlock.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\BFE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\bi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bidispl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\BioCredProv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bisrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\BitLockerDeviceEncryption.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\BitLockerWizardElev.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\bitsadmin.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\bitsigd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bitsperf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bitsprx2.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bitsprx3.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bitsprx4.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bitsprx5.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bitsprx6.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bitsprx7.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\biwinrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\blackbox.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\blb_ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\BluetoothApis.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bootcfg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\bootim.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\BootMenuUX.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bootsect.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\bootux.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\brdgcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bridgeunattend.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\BrokerLib.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\browcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\browser.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\browseui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bthci.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\BthHFSrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\BthMtpContextHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bthpanapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\BthpanContextHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bthprops.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\BthRadioMedia.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bthserv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\BthSQM.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bthudtask.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\btpanui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Bubbles.scr:$CmdTcID AlternateDataStreams: C:\Windows\system32\BulkOperationHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\BWContextHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ByteCodeGenerator.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\cabinet.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cabview.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cacls.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\calc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\CallButtons.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\CallButtons.ProxyStub.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\CameraSettingsUIHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\capiprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\capisp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\catsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\catsrvps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\catsrvut.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cca.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cdd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cdosys.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\certca.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\certcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\certCredProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\certenc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\CertEnroll.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\CertEnrollCtrl.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\CertEnrollUI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\certmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\CertPolEng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\certprop.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\certreq.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\certutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\cewmdm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cfgbkend.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cfgmgr32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cfmifs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cfmifsproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\charmap.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\chartv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\chcp.com:$CmdTcID AlternateDataStreams: C:\Windows\system32\CheckNetIsolation.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\chkdsk.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\chkntfs.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\chkwudrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\choice.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\CHxReadingStringIME.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ci.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cic.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cipher.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\CIRCoInst.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\clb.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\clbcatq.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cleanmgr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\clfsw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cliconfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cliconfg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\clip.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\CloudNotifications.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\CloudStorageWizard.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\clrhost.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\clusapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmcfg32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmd.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmdext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmdial32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmdkey.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmdl32.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmifw.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmlua.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmmon32.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmpbk32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmstp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmstplua.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cmutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cngcredui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cngprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cnvfat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cofire.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\cofiredm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\colbact.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\COLORCNV.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\colorcpl.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\colorui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\combase.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\comcat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\comctl32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\comdlg32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\comp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\compact.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\CompMgmtLauncher.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\CompPkgSup.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\compstui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ComputerDefaults.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\comrepl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\comsnap.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\comsvcs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\comuid.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ConfigureExpandedStorage.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\conhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\connect.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ConnectedAccountState.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\consent.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ConsentUX.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\console.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\control.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\convert.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\correngine.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\CPFilters.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\CredentialMigrationHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\CredentialUIBroker.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\credssp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\credui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\credwiz.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\crypt32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptbase.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptcatsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptdlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptdll.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\CryptoWinRT.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\crypttpmeksvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptuiwizard.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptxml.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cscapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cscdll.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cscript.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\csrsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\CSystemEventsBrokerClient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ctfmon.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\cttune.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\cttunesvr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\C_G18030.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\C_IS2022.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\C_ISCII.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\d2d1.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3d10.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3d10core.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3d10level9.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3d10warp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3d10_1.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3d10_1core.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3d11.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3d8thk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3d9.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\D3DCompiler_47.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3dx10_43.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3dx11_43.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\D3DX9_43.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dab.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dabapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DAConn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dafBth.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DafPrintProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dafupnp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dafWCN.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dafWfdProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DAFWSD.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DAMM.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DaOtpCredentialProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\das.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dasHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dataclen.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\datusage.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\davclnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\davhlpr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dbgeng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dbghelp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dbnetlib.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dbnmpntw.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dccw.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dcomcnfg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dcomp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DDACLSys.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ddodiag.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\DDOIProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DDORes.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ddraw.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ddrawex.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DefaultDeviceManager.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DefaultPrinterProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Defrag.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\defragproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\defragsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\delegatorprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\desk.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\deskadp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\deskmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DevDispItemProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\devenum.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\deviceaccess.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\deviceassociation.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DeviceCenter.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DeviceDisplayStatusManager.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DeviceDriverRetrievalClient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DeviceEject.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\DeviceElementSource.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DeviceMetadataRetrievalClient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DevicePairing.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DevicePairingFolder.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DevicePairingProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DevicePairingWizard.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\DeviceProperties.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\deviceregistration.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DeviceSetupManager.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DeviceSetupManagerAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DeviceSetupStatusProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DeviceUxRes.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\devmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\devobj.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DevPropMgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\devrtl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dfdts.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DFDWiz.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dfp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\DfpCommon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dfrgui.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dfscli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DfsShlEx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dhcpcmonitor.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dhcpcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dhcpcore6.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dhcpcsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dhcpcsvc6.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DHCPQEC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\dhcpsapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DiagCpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\diagperf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\diagtrack.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dialer.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\difxapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dimsjob.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dimsroam.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dinput.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dinput8.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\discan.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\diskcomp.com:$CmdTcID AlternateDataStreams: C:\Windows\system32\diskcopy.com:$CmdTcID AlternateDataStreams: C:\Windows\system32\diskcopy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\diskpart.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\diskperf.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\diskraid.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\Dism.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\DismApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dispci.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dispdiag.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dispex.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Display.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DisplaySwitch.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\djoin.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dllhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dllhst3g.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dlnashext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dmdlgs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dmdskmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dmintf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dmloader.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dmocx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DMRServer.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dmsynth.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dmusic.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dmutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dmvdsitf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dmview.ocx:$CmdTcID AlternateDataStreams: C:\Windows\system32\dnsapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dnscacheugc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dnsext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dnshc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dnsrslvr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\docprop.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\doskey.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dot3api.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dot3cfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Dot3Conn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dot3dlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dot3gpclnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dot3gpui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dot3hc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dot3mm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dot3msm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dot3svc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dot3ui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dpapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dpapimig.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dpapiprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dpapisrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DpiScaling.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\driverquery.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\drmmgrtn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\drmv2clt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\drprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\drt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\drtprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\drttransport.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\drvcfg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\drvinst.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\drvstore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dsauth.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DscCore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DscCoreConfProv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dsdmo.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dskquota.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dskquoui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DsmUserTask.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dsound.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dsparse.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dsprop.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dsquery.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dsrole.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dssec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dssenh.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Dsui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dsuiext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dswave.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dtsh.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dui70.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\duser.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dvdplay.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dvdupgrd.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dwm.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dwmapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dwmcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dwmredir.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DWrite.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DWWIN.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\dxdiag.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dxdiagn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dxgi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dxgwdi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dxmasf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DXP.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dxpps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Dxpserver.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\DxpTaskSync.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dxtmsft.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dxtrans.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dxva2.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Eap3Host.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\eapp3hst.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\eappcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\eappgnui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\eapphost.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\eappprxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\eapprovp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\EAPQEC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\eapsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\easconsent.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\EaseOfAccessDialog.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\easinvoker.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\easinvoker.proxystub.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\easwrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\efsadu.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\efscore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\efslsaext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\efssvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\efsui.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\efsutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\efswrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\EhStorAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\EhStorAuthn.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\EhStorPwdMgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\EhStorShell.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\els.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ELSCore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\elshyph.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\elslad.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\elsTrans.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\encapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\EncDec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\EncDump.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\energy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\energyprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\energytask.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\eqossnap.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\es.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\esent.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\esentprf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\esentutl.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\eudcedit.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\EventAggregation.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\eventcls.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\eventcreate.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\eventvwr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\evr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\expand.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ExplorerFrame.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ext-ms-win-kernel32-package-l1-1-1.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ext-ms-win-ntuser-private-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ext-ms-win-ntuser-private-l1-1-1.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ext-ms-win-session-winsta-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\extrac32.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\f3ahvoas.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Faultrep.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\fdBth.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fdBthProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FdDevQuery.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fde.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fdeploy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fdPHost.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fdPnp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fdprint.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fdProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FDResPub.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fdSSDP.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fdWCN.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fdWNet.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fdWSD.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\feclient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhautoplay.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhcat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhcleanup.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhcpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhengine.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhevents.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhlisten.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhmanagew.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhshl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhsrchapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhsrchph.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhsvcctl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fhtask.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FileAppxStreamingDataSource.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\filemgmt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\find.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\findnetprinters.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\findstr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\finger.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\Firewall.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\FirewallAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FirewallControlPanel.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fixmapi.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\fltLib.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fltMC.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\fmapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fmifs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fms.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FntCache.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Fondue.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\fontext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fontview.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\forfiles.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\format.com:$CmdTcID AlternateDataStreams: C:\Windows\system32\fphc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\framedyn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\framedynos.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\frprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fsavailux.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\fsutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\fsutilext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fthsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ftp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\fundisc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fveapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fveapibase.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fvecerts.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fvecpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fvenotify.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\fveskybackup.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fveui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fvewiz.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fwcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FWPUCLNT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\FwRemoteSvr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSCOM.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSCOMEX.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSCOMPOSE.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSCOVER.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSMON.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSROUTE.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSST.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSSVC.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXST30.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSTIFF.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSUNATD.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\FXSUTILITY.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\g711codc.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\gacinstall.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\gameux.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\gcdef.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\gdi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\GdiPlus.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\GeofenceMonitorService.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\getmac.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\getuname.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\glcndFilter.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\glmf32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\GlobCollationHost.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\globinputhost.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\glu32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\gpapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\gpedit.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\gpprnext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\gpresult.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\gpsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\gptext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\gpupdate.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\Groupinghc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\grpconv.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\hal.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hbaapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hcproviders.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hdwwiz.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\hdwwiz.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\help.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\HelpPaneProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hgcpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hgprint.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hhctrl.ocx:$CmdTcID AlternateDataStreams: C:\Windows\system32\hhsetup.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hid.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hidphone.tsp:$CmdTcID AlternateDataStreams: C:\Windows\system32\hidserv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hlink.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hnetcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hnetmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\HOSTNAME.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\hotplug.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hotspotauth.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hpzllw71.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\httpapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\httpprxm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\httpprxp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\htui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\hwrcomp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\hwrreg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ias.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iasacct.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iasads.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iasdatastore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iashlpr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\IasMigPlugin.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iasnap.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iaspolcy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iasrad.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iasrecst.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iassam.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iassdo.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iassvcs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\icacls.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\icfupgd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\icm32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\icmui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\IconCodecService.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\icsigd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\icsunattend.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\icsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\IdCtrls.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\IdListen.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\idndl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\IDStore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ie4uinit.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\IEAdvpack.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ieapfltr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iedkcs32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ieetwcollector.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ieetwcollectorres.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ieetwproxystub.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ieframe.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iepeers.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iernonce.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iertutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iesetup.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iesysprep.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ieui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ieUnatt.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\iexpress.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ifmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ifsutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ifsutilx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\igdDiag.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\IKEEXT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\imaadp32.acm:$CmdTcID AlternateDataStreams: C:\Windows\system32\imagehlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\imapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\imapi2.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\imapi2fs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\imgutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\imm32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\immersivetpmvscmgrsvr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\inetcomm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\inetcpl.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\inetmib1.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\inetpp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\inetppui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\InfDefaultInstall.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\InkEd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\input.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\InputSwitch.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\inseng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\intl.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\ipconfig.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\IPHLPAPI.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\iphlpsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ipnathlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iprtprio.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iprtrmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ipsecsnp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\IPSECSVC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\ipsmsnap.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\irclass.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\irftp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\irmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\irprops.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\iscsicli.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\iscsicpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iscsicpl.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\iscsidsc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iscsied.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iscsiexe.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iscsium.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iscsiwmi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iscsiwmiv2.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\isoburn.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\itircl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\itss.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iuilp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\iyuv_32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\JavaScriptCollectionAgent.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\jnwmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\joy.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\jscript.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\jscript9.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\jscript9diag.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\jsproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\KBDAZE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\KBDAZEL.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\KBDAZST.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\KBDBASH.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\kbdgeoqw.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\KBDRU.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\KBDRU1.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\KBDRUM.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\KBDTAT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\KBDTT102.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\KBDYAK.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\KdsCli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\kdusb.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\kd_02_8086.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\keepaliveprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\kerberos.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\kernel.appcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\kernel32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\KernelBase.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\kernelceip.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\keyiso.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\keymgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\klist.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\kmddsp.tsp:$CmdTcID AlternateDataStreams: C:\Windows\system32\KMSVC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\korwbrkr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ksetup.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ksproxy.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\kstvtune.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\ksuser.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Kswdmcap.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\ksxbar.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\ktmutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ktmw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\l2gpstore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\l2nacp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\L2SecHC.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\l3codeca.acm:$CmdTcID AlternateDataStreams: C:\Windows\system32\l3codecp.acm:$CmdTcID AlternateDataStreams: C:\Windows\system32\label.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\LangCleanupSysprepAction.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\LAPRXY.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\LaunchTM.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\licmgr10.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\linkinfo.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ListSvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\livessp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\LldpNotify.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\lltdapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\lltdsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\lmhsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\loadperf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\localsec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\localspl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\localui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\LocationApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\LocationNotifications.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\Locator.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\LockScreenContent.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\LockScreenContentHost.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\LockScreenContentServer.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\lodctr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\logagent.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\loghours.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\logman.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\logoncli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\LogonUI.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\lpkinstall.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\lpksetup.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\lpksetupproxyserv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\lpremove.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\lsasrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\lsass.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\lsm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\lsmproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\luainstall.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Magnification.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Magnify.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\main.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\MaintenanceUI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\makecab.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\manage-bde.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mapistub.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MbaeApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MbaeApiPublic.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MbaeParserTask.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\MbaeXmlParser.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mblctr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mbsmsapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mbussdapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mcbuilder.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mciavi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mcicda.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mciqtz32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mciseq.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mciwave.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mcupdate_GenuineIntel.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\McxDriv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MDEServer.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\MDMAgent.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mdminst.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mdmregistration.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MdRes.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\MdSched.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\MemoryDiagnostic.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mf3216.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfAACEnc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfasfsrcsnk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfc42.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfc42u.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MFCaptureEngine.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfcsubs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfds.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfdvdec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfh264enc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MFMediaEngine.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfmjpegdec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfmp4srcsnk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfmpeg2srcsnk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfnetcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfnetsrc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfplat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MFPlay.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfpmp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfreadwrite.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfsrcsnk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfsvr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mftranscode.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfvdsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MFWMAAEC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\mgmtapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mibincodec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\microsoft-windows-kernel-power-events.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\microsoft-windows-system-events.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Microsoft.Management.Infrastructure.Native.Unmanaged.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MicrosoftAccountTokenProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\midimap.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\migflt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\migisol.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\miguiresource.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mimefilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mimofcodec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MirrorDrvCompat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mispace.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\miutils.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mlang.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mmc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mmcbase.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mmci.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mmcico.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mmcndmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mmcshext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mmcss.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MMDevAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mmsys.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\mobsync.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mode.com:$CmdTcID AlternateDataStreams: C:\Windows\system32\modemui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\montr_ci.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\more.com:$CmdTcID AlternateDataStreams: C:\Windows\system32\mountvol.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\MP3DMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\MP43DECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\MP4SDECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\Mpeg2Data.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\mpg2splt.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\MPG4DECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\mpnotify.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mpr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mprapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mprddm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mprdim.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mprext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mprmsg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MPSSVC.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MRINFO.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\MrmIndexer.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MRT.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mrt100.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mrt_map.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msaatext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSAC3ENC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\msacm32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msacm32.drv:$CmdTcID AlternateDataStreams: C:\Windows\system32\msadp32.acm:$CmdTcID AlternateDataStreams: C:\Windows\system32\msasn1.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSAudDecMFT.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msaudite.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msauserext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mscandui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mscat32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msched.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSchedExe.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mscms.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msconfig.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\msctf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msctfime.ime:$CmdTcID AlternateDataStreams: C:\Windows\system32\MsCtfMonitor.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msctfp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msctfui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msctfuimanager.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdadiag.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdart.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdelta.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdmo.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdri.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdrm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdt.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdtc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdtckrm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdtclog.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdtcprx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdtctm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdtcuiu.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSDvbNP.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\msdxm.ocx:$CmdTcID AlternateDataStreams: C:\Windows\system32\msfeeds.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msfeedsbs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msfeedssync.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\msftedit.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msg711.acm:$CmdTcID AlternateDataStreams: C:\Windows\system32\msgsm32.acm:$CmdTcID AlternateDataStreams: C:\Windows\system32\mshta.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mshtml.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MshtmlDac.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mshtmled.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MsiCofire.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msidcrl40.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msident.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msidle.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msieftp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msiexec.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\msihnd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msiltcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msimg32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msimtf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msinfo32.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\msisip.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msiwer.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mskeyprotcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mskeyprotect.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msls31.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msmpeg2adec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSMPEG2ENC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\msmpeg2vdec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msnetobj.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSNP.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\msoeacct.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msoert2.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mspaint.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mspatcha.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mspatchc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msports.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msra.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\msrahc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msrating.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msrdc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MsRdpWebAccess.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msrle32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msscntrs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msscp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mssha.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msshooks.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mssign32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mssip32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mssitlb.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MsSpellCheckingFacility.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MsSpellCheckingHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mssph.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mssphtb.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mssprxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mssrch.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mssvp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mstask.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msTextPrediction.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mstsc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mstscax.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msutb.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msv1_0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msvcirt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msvcp60.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msvcr120_clr0400.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msvcrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msvfw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msvidc32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSVidCtl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSVideoDSP.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msvproc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSWB7.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSWB70011.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSWB7001E.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSWB70404.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSWB70804.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mswmdm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mswsock.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msxml3.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msxml6.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msyuv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mtstocom.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mtxclu.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mtxdm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mtxex.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mtxoci.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\muifontsetup.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MUILanguageCleanup.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MuiUnattend.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\MultiDigiMon.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mycomput.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mydocs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Mystify.scr:$CmdTcID AlternateDataStreams: C:\Windows\system32\napdsnap.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NapiNSP.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\napipsec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NAPMONTR.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\NAPSTAT.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\Narrator.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\NaturalLanguage6.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nbtstat.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\NcaApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NcaSvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ncbservice.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NcdProp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nci.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ncobjapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ncpa.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\ncrypt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ncryptprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ncryptsslp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ncuprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ndadmin.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\nddeapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ndfapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ndfetw.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ndfhcdiscovery.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ndiscapCfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ndishc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NdisImPlatform.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ndproxystub.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nduprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\negoexts.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\net.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\net1.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\netapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netbios.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netbtugc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\netcenter.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netcfg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\netcfgx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netcorehc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netdiagfx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NetEvtFwdr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\netid.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netiohlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netiougc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\netjoin.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netlogon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netman.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netplwiz.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Netplwiz.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\netprofm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netprofmsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netprovisionsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NetSetupApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netsh.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\netshell.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NETSTAT.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\nettrace.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netutils.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NetVscCoinstall.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\networkexplorer.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\networkitemfactory.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NetworkStatus.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\newdev.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\newdev.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ninput.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NL7Data0011.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NL7Data001E.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NL7Data0404.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NL7Data0804.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nlahc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nlhtml.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nlmgp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nlmproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nlmsprep.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0000.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0002.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0003.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0007.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0009.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData000a.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData000c.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData000d.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData000f.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0010.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0018.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData001a.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData001b.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData001d.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0020.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0021.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0022.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0024.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0026.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0027.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData002a.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0039.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData003e.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0045.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0046.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0047.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0049.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData004a.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData004b.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData004c.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData004e.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0414.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0416.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0816.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData081a.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsData0c1a.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Nlsdl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NlsLexicons0009.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nltest.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\normaliz.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\notepad.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\npmproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nrpsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nshhttp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nshipsec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nshwfp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nsi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nsisvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nslookup.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntasn1.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntdll.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntdsapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntlanman.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntlanui2.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntmarta.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntoskrnl.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntprint.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntprint.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntshrui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntvdm64.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvapi64.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvaudcap64v.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvcuda.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvcuvid.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvd3dumx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvdispco6435891.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvdispgenco6435891.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvEncodeAPI64.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NvFBC64.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvhdagenco6420103.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvhdap64.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NvIFR64.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\NvIFROpenGL.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvinitx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvmcumd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvoglshim64.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvoglv64.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvopencl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvumdshimx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvvsvc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\nvwgf2umx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\objsel.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\occache.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ocsetapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbc32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbcad32.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbcbcp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbcconf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbcconf.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbccp32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbccr32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbccu32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbctrac.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\OEMLicense.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\offfilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\offreg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ogldrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ole32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\oleacc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\oleacchooks.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\oledlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\oleprn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\OnDemandConnRouteHelper.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\onex.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\onexui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\OobeFldr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\OpcServices.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\OpenCL.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\openfiles.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\opengl32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\OpenWith.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\OptionalFeatures.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\osbaseln.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\osk.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\OskSupport.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\osuninst.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\P2P.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\P2PGraph.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\p2pnetsh.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\p2psvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\packager.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PackageStateRoaming.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\panmap.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PasswordOnWakeSettingFlyout.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\PATHPING.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\pautoenr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcacli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcadm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcalua.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcasvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcaui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcaui.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\PCPKsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PCPTpm12.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcsvDevice.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcwrun.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcwutl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pdh.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pdhui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\perfctrs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\perfdisk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\perfmon.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\perfnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\perfos.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\perfproc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\perftrack.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\perfts.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PhotoScreensaver.scr:$CmdTcID AlternateDataStreams: C:\Windows\system32\photowiz.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PickerHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\pid.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PING.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\PkgMgr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\pku2u.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pla.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\plasrv.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\playlistfolder.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PlaySndSrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PlayToDevice.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PlayToManager.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PlayToStatusProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ploptin.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pngfilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pnidui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pnpclean.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pnppolicy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pnpts.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pnpui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PnPUnattend.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\PnPutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\PNPXAssoc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PNPXAssocPrx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pnrpauto.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Pnrphc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pnrpnsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pnrpsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\polstore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\poqexec.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\PortableDeviceApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PortableDeviceClassExtension.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PortableDeviceConnectApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PortableDeviceStatus.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PortableDeviceSyncProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PortableDeviceTypes.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PortableDeviceWiaCompat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PortableDeviceWMDRM.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pots.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\powercfg.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\powercfg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\powercpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\powrprof.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PresentationNative_v0300.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\prevhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\print.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\PrintDialogHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\PrintDialogs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\printfilterpipelineprxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\printfilterpipelinesvc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\PrintIsolationHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\PrintIsolationProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\printui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\printui.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\prncache.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\prnfldr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\prnntfy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\prntvpt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\procinst.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\profapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\profext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\profprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\profsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\profsvcext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\propsys.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\proquota.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\provcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\provsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\provthrd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ProximityCommon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ProximityCommonPal.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ProximityRtapiPal.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ProximityService.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ProximityServicePal.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ProximityUxHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\prvdmofcomp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\psapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PSHED.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\psisdecd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\psisrndr.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\PSModuleDiscoveryProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\psmsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\psr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\pstask.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pstorec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\puiapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\puiobj.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PurchaseWindowsLicense.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\PurchaseWindowsLicense.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\pwlauncher.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pwlauncher.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\pwrshplugin.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pwsso.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\QAGENT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\QAGENTRT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\qasf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\QCLIPROV.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\qdv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\qdvd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\qedit.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\qmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\qmgrprxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\QSHVHOST.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\QSVRMGMT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\quartz.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Query.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\QUTIL.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\qwave.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RacEngn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\racpldlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\radardt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\radarrs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RADCUI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasadhlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasauto.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasautou.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rascfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\raschap.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\raschapext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasctrs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rascustom.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasdiag.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasdial.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasdlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\raserver.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasgcw.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasman.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasmans.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasmbmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RASMM.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasmontr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasmxs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasphone.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasplap.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasppp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rasser.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rastls.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rastlsext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdbui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdpcfgex.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdpclip.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdpcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdpcorets.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdpencom.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdpendp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdpinput.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RdpSa.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RdpSaProxy.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RdpSaPs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RdpSaUacHelper.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdpudd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdrleakdiag.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RDSAppXHelper.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdsdwmdr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RDSPnf.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdvidcrl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdvvmtransport.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ReAgent.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ReAgentc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ReAgentTask.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\recimg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\recover.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\recovery.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RecoveryDrive.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\reg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\regapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RegCtrl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\regedt32.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\regidle.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\regini.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\Register-CimProvider.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\regsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\regsvr32.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ReInfo.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rekeywiz.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\relog.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RelPost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\remotepg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\remotesp.tsp:$CmdTcID AlternateDataStreams: C:\Windows\system32\RemoveDeviceContextHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RemoveDeviceElevated.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\repair-bde.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\replace.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RESAMPLEDMO.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\reseteng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\resmon.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RestoreOptIn.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\resutils.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rfxvmt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rgb9rast.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Ribbons.scr:$CmdTcID AlternateDataStreams: C:\Windows\system32\riched20.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\riched32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RMActivate.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RMActivate_isv.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RMActivate_ssp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RMActivate_ssp_isv.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RMapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RmClient.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rmttpmvscmgrsvr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rnr20.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RoamingSecurity.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Robocopy.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RotMgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ROUTE.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\RpcEpMap.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rpchttp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RpcNs4.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rpcnsh.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RpcPing.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rpcrt4.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RpcRtRemote.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rpcss.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rrinstaller.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rsaenh.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rshx32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RstrtMgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rstrui.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rtffilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rtm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rtutils.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\RTWorkQ.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\runas.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rundll32.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RunLegacyCPLElevated.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\runonce.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RuntimeBroker.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\samcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\samlib.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\samsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sas.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sbe.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sbeio.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\scansetting.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SCardDlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SCardSvr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\scavengeui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sccls.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ScDeviceEnum.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\scecli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\scext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\schannel.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\schedcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\schedsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\schtasks.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\scksp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\scripto.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\scrnsave.scr:$CmdTcID AlternateDataStreams: C:\Windows\system32\scrobj.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\scrrun.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sdbinst.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sdchange.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sdclt.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sdhcinst.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sdiageng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sdiagnhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sdiagprv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sdiagschd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sdohlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SearchFilterHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SearchFolder.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SearchIndexer.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SearchProtocolHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SecEdit.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sechost.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\secinit.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\seclogon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\secproc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\secproc_isv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\secproc_ssp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\secproc_ssp_isv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\secur32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sendmail.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Sens.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SensApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SensorsApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SensorsClassExtension.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SensorsCpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sensrsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\serialui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\services.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\serwvdrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SessEnv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sessionmsg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\setbcdlocale.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sethc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SetNetworkLocation.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SetProxyCredential.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\setspn.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SettingMonitor.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SettingsHandlers.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SettingSyncCore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SettingSyncHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SettingSyncPolicy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\setupapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\setupcln.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\setupugc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\setx.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sfc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sfc_os.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sharemediacpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SHCore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shdocvw.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shell32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shfolder.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shgina.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shimeng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shimgvw.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shlwapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shpafact.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shrpubw.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\shsetup.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shsvcs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shunimpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shutdown.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\shwebsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\signdrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sigverif.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SimAuth.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SimCfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sisbkup.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SkyDrive.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SkyDriveShell.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SkyDriveTelemetry.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\slc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SlideToShutDown.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\slpts.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SmartcardCredentialProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SmartCardSimulator.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SmartScreenSettings.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SMBHelperClass.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\smbwmiv2.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\smphost.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SmsDeviceAccessRevocation.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SMSRouter.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\smss.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SndVol.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SndVolSSO.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SnippingTool.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\snmpapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\snmptrap.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SNTSearch.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\softkbd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\softpub.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sort.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SortServer2003Compat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SortWindows61.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SortWindows6Compat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SoundRecorder.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SpaceAgent.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SpaceControl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\spbcd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\spcompat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\spfileq.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SPInf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\spmpm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\spnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\spoolss.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\spoolsv.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\spopk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\spp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sppc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sppcomapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sppnp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sppobjs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sppsvc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sppwinob.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\spwinsat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\spwizeng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\spwmp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sqlcecompact40.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sqlceoledb40.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sqlceqp40.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sqlcese40.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sqlsrv32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sqmapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\srchadmin.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\srclient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\srcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SRH.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\srhelper.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\srrstr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SrTasks.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\srumapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\srumsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\srvcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\srvsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\srwmi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sscore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sscoreext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ssdpapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ssdpsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sspicli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sspisrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SSShim.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ssText3d.scr:$CmdTcID AlternateDataStreams: C:\Windows\system32\sstpsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Startupscan.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\stclient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sti.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\StikyNot.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sti_ci.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\stobject.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\StorageContextHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\storagewmi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\storagewmi_passthru.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\storewuauth.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Storprop.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\StorSvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\streamci.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\StructuredQuery.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SubscriptionMgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\subst.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sud.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\svchost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\svsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\swprv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sxproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sxs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sxshared.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sxssrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sxsstore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sxstrace.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SyncCenter.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\synceng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SyncEngine.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SyncHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SyncHostps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SyncInfrastructure.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SyncInfrastructureps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Syncreg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\syncui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sysclass.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sysdm.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\SysFxUI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\syskey.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sysmain.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sysmon.ocx:$CmdTcID AlternateDataStreams: C:\Windows\system32\sysntfy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SysResetErr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\syssetup.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\systemcpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemEventsBrokerClient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemEventsBrokerServer.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\systeminfo.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemPropertiesAdvanced.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemPropertiesComputerName.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemPropertiesHardware.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemPropertiesPerformance.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemPropertiesProtection.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemPropertiesRemote.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\systemreset.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemSettings.DeviceEncryptionHandlers.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemSettings.Handlers.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemSettingsAdminFlows.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemSettingsAdminFlowUI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemSettingsDatabase.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\SystemSettingsRemoveDevice.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\systray.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\t2embed.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Tabbtn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TabbtnEx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tabcal.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\TabletPC.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\TabSvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\takeown.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\tapi3.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tapilua.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TapiMigPlugin.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tapiperf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tapisrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TapiSysprep.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TapiUnattend.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\taskbarcpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\taskcomp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\taskeng.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\taskhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\taskhostex.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\taskkill.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\tasklist.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\Taskmgr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\taskschd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TaskSchdPS.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tbs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tcmsetup.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\tcpipcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TcpipSetup.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tcpmib.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tcpmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tcpmonui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TCPSVCS.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\tdc.ocx:$CmdTcID AlternateDataStreams: C:\Windows\system32\tdh.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\telephon.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\termmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\termsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TetheringIeProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TetheringMgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TetheringStation.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\themecpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\themeservice.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\themeui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\threadpoolwinrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\thumbcache.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ThumbnailExtractionHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\TimeBrokerClient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TimeBrokerServer.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\timedate.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\TimeDateMUICallback.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\timeout.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\TimeSyncTask.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tlscsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tpmcompc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TpmInit.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\TpmTasks.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tpmvsc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tpmvscmgr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\tpmvscmgrsvr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\tquery.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tracerpt.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\TRACERT.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\traffic.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tree.com:$CmdTcID AlternateDataStreams: C:\Windows\system32\trkwks.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tsbyuv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TSChannel.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tsgqec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tsmf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TSpkg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TSTheme.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\TsUsbGDCoInstaller.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TSWbPrxy.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\TSWorkspace.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TsWpfWrp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\TtlsAuth.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TtlsCfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TtlsExt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tvratings.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\twext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\twinapi.appcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\twinapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\twinui.appcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\twinui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\txflog.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\txfw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\typeperf.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\tzsync.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\tzutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ubpm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ucmhc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ucrtbase.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\udhisapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\uDWM.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\uexfat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ufat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\UI0Detect.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\UIAnimation.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\UIAutomationCore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\uicom.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\uireng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\UIRibbon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\UIRibbonRes.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ulib.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\umb.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\umdmxfrm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\umpnpmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\umpo.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\umpoext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\umpowmi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\umrdp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\unattend.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\unimdm.tsp:$CmdTcID AlternateDataStreams: C:\Windows\system32\unimdmat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\uniplat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\unlodctr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\unregmp2.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\untfs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\upnp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\upnpcont.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\upnphost.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ureg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\url.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\urlmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\usbceip.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\usbmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\usbperf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\usbui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\user32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\UserAccountBroker.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\UserAccountControlSettings.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\UserAccountControlSettings.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\usercpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\userenv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\userinit.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\userinitext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\UserLanguageProfileCallback.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\UserLanguagesCpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\usp10.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ustprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\UtcResources.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\utildll.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Utilman.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\uudf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\UXInit.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\uxlib.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\uxtheme.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\VAN.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Vault.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vaultcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\VaultCmd.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\VaultRoaming.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vaultsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\VBICodec.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\vbisurf.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\vbscript.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vds.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\vdsbas.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vdsdyn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vdsldr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\vdsutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vdsvd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vds_ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\verclsid.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\verifier.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\verifier.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\version.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vfwwdm32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vidcap.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\VIDRESZR.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\virtdisk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\VmApplicationHealthMonitorProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vmbuspipe.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\VmdCoinstall.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vmictimeprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vmnetbridge.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vmrdvcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vnetinst.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vpnike.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vpnikeapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\VscMgrPS.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vssadmin.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\vssapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\vsstrace.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\VSSVC.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\vss_ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\w32time.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\w32tm.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\w32topl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WABSyncProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\waitfor.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WallpaperHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WavDest.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wavemsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wbadmin.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wbemcomn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wbengine.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wbiosrvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wcmapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wcmcsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wcmsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WcnApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wcncsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WcnEapAuthProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WcnEapPeerProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WcnNetsh.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wcnwiz.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WcsPlugInService.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wdc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wdi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wdiasqmmodule.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wdigest.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wdmaud.drv:$CmdTcID AlternateDataStreams: C:\Windows\system32\wdscore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WebcamUi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\webcheck.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WebClnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\webio.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\webservices.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Websocket.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wecapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wecsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wecutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wephostsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wer.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\werconcpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wercplsupport.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\werdiagcontroller.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WerFault.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WerFaultSecure.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wermgr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wersvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\werui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wevtapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wevtfwd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wevtsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wevtutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wextract.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wfapigp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wfdprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WfHC.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WFS.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\where.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\whhelper.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\whoami.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wiaacmgr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wiaaut.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wiadefui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wiadss.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wiarpc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wiascanprofiles.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wiaservc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wiashext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wiatrace.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WiFiDisplay.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wimgapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wimserv.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\win32k.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\win32spl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winbici.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winbio.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winbrand.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wincorlib.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wincredprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.ApplicationModel.Background.SystemEventsBroker.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.ApplicationModel.Background.TimeBroker.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.ApplicationModel.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.ApplicationModel.Store.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Data.Pdf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Background.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Background.ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Bluetooth.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Custom.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Custom.ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Enumeration.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Enumeration.ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Geolocation.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.PointOfService.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Portable.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Printers.Extensions.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Scanners.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Sensors.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.SmartCards.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.Usb.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Devices.WiFiDirect.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Globalization.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Globalization.Fontgroups.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Graphics.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Graphics.Printing.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\windows.immersiveshell.serviceprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Management.Workplace.WorkplaceSettings.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Media.Devices.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Media.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Media.MediaControl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Media.Renewal.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Media.SpeechSynthesis.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Media.Streaming.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Media.Streaming.ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Networking.BackgroundTransfer.ContentPrefetchTask.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Networking.BackgroundTransfer.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Networking.Connectivity.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Networking.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Networking.HostName.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Networking.NetworkOperators.HotspotAuthentication.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Networking.Proximity.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Networking.Sockets.PushEnabledApplication.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Networking.Vpn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Security.Authentication.OnlineId.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Security.Credentials.UI.CredentialPicker.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Security.Credentials.UI.UserConsentVerifier.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Shell.Search.UriHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Storage.ApplicationData.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Storage.Compression.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.System.Display.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.System.Profile.HardwareId.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.System.Profile.SystemManufacturers.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.System.RemoteDesktop.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.UI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.UI.Input.Inking.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.UI.Search.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.UI.Xaml.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Web.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Windows.Web.Http.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WindowsAnytimeUpgrade.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WindowsAnytimeUpgradeResults.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WindowsAnytimeUpgradeui.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WindowsCodecsExt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\windowslivelogin.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winethc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinFax.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winhttp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wininet.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wininit.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wininitext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winipsec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Winlangdb.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winload.efi:$CmdTcID AlternateDataStreams: C:\Windows\system32\winload.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\winlogon.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\winlogonext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winmde.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winmm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winmmbase.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinMsoIrmProtector.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winnsi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinOpcIrmProtector.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winresume.efi:$CmdTcID AlternateDataStreams: C:\Windows\system32\winresume.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\winrnr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winrs.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\winrscmd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winrshost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\winrssrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinRtTracing.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinSAT.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinSATAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinSCard.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinSetupUI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winsku.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winsockhc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winspool.drv:$CmdTcID AlternateDataStreams: C:\Windows\system32\WINSRPC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\winsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winsta.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinSync.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinSyncMetastore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinSyncProviders.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wintrust.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinTypes.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winusb.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winver.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wisp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\witnesswmiv2provider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wkscli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wkspbroker.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wkspbrokerAx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wksprt.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wksprtPS.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wkssvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlanapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlancfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WLanConn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlandlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlanext.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlangpui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WLanHC.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlanhlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlaninst.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WlanMM.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlanmsm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlanpref.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WlanRadioManager.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlansec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlansvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlansvcpal.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlanui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Wldap32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wldp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlgpclnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlidcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlidcredprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlidfdp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlidnsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlidprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlidsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wlrmdr.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WlS0WndH.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMADMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMADMOE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMALFXGFXDSP.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMASF.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmcodecdspps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmdmlog.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmdmps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmdrmdev.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmdrmnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmdrmsdk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmiclnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmicmiplugin.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmidcom.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmidx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmiprop.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmitomi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMNetMgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMPDMC.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WmpDui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmpdxm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmpeffects.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMPhoto.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmpmde.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmpps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmpshell.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmsgapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMSPDMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMSPDMOE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMVCORE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMVDECOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmvdspa.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMVENCOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMVSDECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMVSENCD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMVXENCD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WofTasks.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WofUtil.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\workerdd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WorkFolders.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WorkfoldersControl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WorkFoldersGPExt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WorkFoldersRes.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WorkFoldersShell.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\workfolderssvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wow64.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wow64cpu.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wow64win.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wowreg32.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\Wpc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wpccpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WpcMon.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wpcsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WpcWebSync.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wpdbusenum.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wpdshext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WPDShextAutoplay.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WPDShServiceObj.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WPDSp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wpd_ci.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wpnapps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wpncore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wpninprc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wpnpinst.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wpnprv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wpnsruprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\write.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ws2help.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ws2_32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wscapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wscinterop.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wscisvif.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSClient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSCollect.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wscproxystub.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wscript.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wscsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wscui.cpl:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSDApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wsdchngr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSDMon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSDPrintProxy.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSDScanProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wsecedit.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wsepno.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wshbth.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wshcon.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wshelper.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wshext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wship6.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wshirda.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wshnetbs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wshom.ocx:$CmdTcID AlternateDataStreams: C:\Windows\system32\wshqos.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wshrm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSHTCPIP.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WsmAgent.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSManHTTPConfig.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSManMigrationPlugin.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WsmAuto.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wsmplpxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wsmprovhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WsmSvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WsmWmiPl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wsnmp32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wsock32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wsqmcons.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSReset.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSService.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSShared.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSSync.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WSTPager.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\wtsapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wu.upgrade.ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wuaext.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wuapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wuapp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wuauclt.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wuaueng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wucltux.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WUDFCoinstaller.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WUDFHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WUDFPlatform.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WUDFSvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WUDFx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WUDFx02000.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wudriver.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wups.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wups2.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wusa.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WUSettingsProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wuwebv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WwaApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WWAHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WWanAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wwancfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wwanconn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WWanHC.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wwaninst.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wwanmm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Wwanpref.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wwanprotdim.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WwanRadioManager.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wwansvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wwapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\XAudio2_8.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\xcopy.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\XInput1_4.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\XInput9_1_0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\xmlfilter.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\xmllite.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\xmlprovi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\xolehlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\XpsFilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\XpsGdiConverter.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\XpsPrint.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\XpsRasterService.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\xpsrchvw.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\xpsservices.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\XPSSHHDR.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\xpssvcs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\xwizard.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\xwizards.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\xwreg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\xwtpdui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\xwtpw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\zipfldr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\accessibilitycpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\acledit.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\aclui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\acppage.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ActionCenter.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ActionCenterCPL.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\activeds.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\actxprxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\adprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\adsldp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\adsldpc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\adsmsext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\adsnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\adtschema.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\advapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\advpack.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\amstream.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\apds.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\apphelp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Apphlpdm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\appidapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\apprepapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\apprepsync.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\appwiz.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AppxAllUserStore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AppxApplicabilityEngine.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AppXDeploymentClient.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AppxPackaging.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AppxSip.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ARP.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\aspnet_counters.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\asycfilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\at.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AtBroker.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\atl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\atlthunk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\attrib.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\audiodev.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AudioEng.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AUDIOKSE.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AudioSes.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\auditpol.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AuthBroker.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AuthExt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\authfwcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AuthFWGP.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AuthFWSnapin.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AuthFWWizFwk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\authui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\authz.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\autochk.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\autoconv.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\autofmt.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\autoplay.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\avicap32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\avifil32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\avrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\azroles.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\azroleui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AzSqlExt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\backgroundTaskHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\BackgroundTransferHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\basecsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\batmeter.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bcd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\BCP47Langs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bcrypt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bcryptprimitives.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bdaplgin.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bidispl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\BioCredProv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bitsadmin.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bitsperf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bitsprx2.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bitsprx3.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bitsprx4.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bitsprx5.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bitsprx6.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bitsprx7.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\biwinrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\blackbox.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\BluetoothApis.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bootcfg.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\browcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\browseui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bthprops.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bthudtask.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\btpanui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Bubbles.scr:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\BWContextHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ByteCodeGenerator.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cabinet.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cabview.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cacls.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\calc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CallButtons.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CallButtons.ProxyStub.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CameraSettingsUIHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\capiprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\capisp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\catsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\catsrvps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\catsrvut.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cca.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cdosys.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\certca.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\certcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\certCredProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\certenc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CertEnroll.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CertEnrollCtrl.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CertEnrollUI.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\certmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CertPolEng.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\certreq.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\certutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cewmdm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cfgbkend.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cfgmgr32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cfmifs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cfmifsproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\charmap.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\chartv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\chcp.com:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CheckNetIsolation.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\chkdsk.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\chkntfs.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\choice.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CHxReadingStringIME.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cic.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cipher.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\clb.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\clbcatq.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cleanmgr.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\clfsw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cliconfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cliconfg.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\clip.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CloudNotifications.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CloudStorageWizard.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\clrhost.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\clusapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmcfg32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmd.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmdext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmdial32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmdkey.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmdl32.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmifw.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmlua.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmmon32.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmpbk32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmstp.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmstplua.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cmutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cngcredui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cngprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cnvfat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\colbact.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\COLORCNV.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\colorcpl.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\colorui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\combase.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\comcat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\comctl32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\comdlg32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\comp.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\compact.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CompPkgSup.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\compstui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ComputerDefaults.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\comrepl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\comsnap.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\comsvcs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\comuid.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ConfigureExpandedStorage.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\connect.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ConnectedAccountState.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\console.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\control.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\convert.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CPFilters.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CredentialMigrationHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CredentialUIBroker.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\credssp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\credui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\credwiz.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\crypt32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptbase.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptdlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptdll.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CryptoWinRT.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\crypttpmeksvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptuiwizard.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptxml.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cscapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cscdll.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cscript.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ctfmon.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cttune.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cttunesvr.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\C_G18030.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\C_IS2022.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\C_ISCII.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d2d1.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3d10.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3d10core.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3d10level9.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3d10warp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3d10_1.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3d10_1core.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3d11.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3d8.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3d8thk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3d9.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_47.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3dim.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3dim700.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3dramp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_43.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3dx11_43.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_43.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3dxof.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dabapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DafPrintProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DaOtpCredentialProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dataclen.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\davclnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\davhlpr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dbgeng.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dbghelp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dbnetlib.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dbnmpntw.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dccw.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dcomcnfg.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dcomp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DDACLSys.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ddodiag.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DDOIProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DDORes.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ddraw.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ddrawex.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DefaultDeviceManager.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DefaultPrinterProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\delegatorprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\desk.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\deskadp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\deskmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DevDispItemProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\devenum.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\deviceaccess.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\deviceassociation.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DeviceCenter.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DeviceDisplayStatusManager.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DevicePairing.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DevicePairingFolder.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DevicePairingProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DevicePairingWizard.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DeviceProperties.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DeviceSetupStatusProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DeviceUxRes.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\devmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\devobj.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\devrtl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dfrgui.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dfscli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DfsShlEx.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dhcpcmonitor.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dhcpcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dhcpcore6.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dhcpcsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dhcpcsvc6.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DHCPQEC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dhcpsapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dialer.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\difxapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dimsjob.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dimsroam.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dinput.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dinput8.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\diskcomp.com:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\diskcopy.com:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\diskcopy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\diskpart.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\diskperf.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\diskraid.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Dism.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DismApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dispex.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Display.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DisplaySwitch.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dllhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dllhst3g.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dlnashext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmband.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmcompos.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmdlgs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmdskmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmime.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmintf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmloader.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmocx.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmscript.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmstyle.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmsynth.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmusic.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmvdsitf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dmview.ocx:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dnsapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\docprop.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\doskey.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dot3api.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dot3cfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dot3dlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dot3gpclnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dot3gpui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dot3hc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dot3msm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dot3ui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dpapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dpapimig.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dpapiprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DpiScaling.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\driverquery.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\drmmgrtn.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\drmv2clt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\drprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\drt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\drtprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\drttransport.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\drvinst.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\drvstore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dsauth.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dsdmo.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dskquota.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dskquoui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dsound.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dsparse.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dsprop.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dsquery.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dsrole.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dssec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dssenh.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Dsui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dsuiext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dswave.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dtsh.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dui70.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\duser.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dvdplay.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dvdupgrd.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dwmapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dwmcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DWrite.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DWWIN.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dxdiag.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dxdiagn.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dxgi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dxmasf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DxpTaskSync.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dxtmsft.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dxtrans.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dxva2.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\eapp3hst.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\eappcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\eappgnui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\eapphost.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\eappprxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\eapprovp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\EAPQEC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\EaseOfAccessDialog.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\easwrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\efsadu.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\efscore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\efsui.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\efsutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\efswrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\EhStorAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\EhStorAuthn.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\EhStorPwdMgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\els.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ELSCore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\elshyph.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\elslad.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\elsTrans.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\encapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\EncDec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\eqossnap.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\es.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\esent.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\esentprf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\esentutl.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\eudcedit.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\eventcls.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\eventcreate.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\eventvwr.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\evr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\expand.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\explorer.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ExplorerFrame.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ext-ms-win-kernel32-package-l1-1-1.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ext-ms-win-networking-wcmapi-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ext-ms-win-ntuser-private-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ext-ms-win-ntuser-private-l1-1-1.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ext-ms-win-session-winsta-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\extrac32.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\f3ahvoas.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Faultrep.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fdBth.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fdBthProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FdDevQuery.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fde.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fdeploy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fdPnp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fdprint.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fdProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fdSSDP.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fdWCN.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fdWNet.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fdWSD.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\feclient.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\filemgmt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\find.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\findnetprinters.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\findstr.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\finger.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FirewallAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FirewallControlPanel.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fixmapi.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FlashPlayerApp.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fltLib.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fltMC.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fmifs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fms.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Fondue.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fontext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fontview.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\forfiles.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\format.com:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fphc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\framedyn.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\framedynos.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\frprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fsutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fsutilext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ftp.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fundisc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fwcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FWPUCLNT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FwRemoteSvr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FXSAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FXSCOM.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FXSCOMEX.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FXSEXT32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FXSXP32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\g711codc.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\gameux.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\gcdef.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\gdi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\GdiPlus.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\GeofenceMonitorService.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\getmac.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\getuname.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\glcndFilter.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\glmf32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\GlobCollationHost.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\globinputhost.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\glu32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\gpapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\gpedit.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\gpprnext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\gpresult.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\gptext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\gpupdate.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\grpconv.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hbaapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hcproviders.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hdwwiz.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hdwwiz.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\help.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\HelpPaneProxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hgcpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hh.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hhctrl.ocx:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hhsetup.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hid.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hidphone.tsp:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hidserv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hlink.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hnetcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\hnetmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\HOSTNAME.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\httpapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\htui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ias.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iasacct.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iasads.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iasdatastore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iashlpr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\IasMigPlugin.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iasnap.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iaspolcy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iasrad.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iasrecst.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iassam.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iassdo.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iassvcs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\icacls.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iccvid.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\icm32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\icmui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\IconCodecService.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\icsigd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\icsunattend.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\IdCtrls.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\idndl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\IDStore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\IEAdvpack.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ieapfltr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iedkcs32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ieetwproxystub.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ieframe.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iepeers.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iernonce.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iertutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iesetup.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iesysprep.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ieui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ieUnatt.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iexpress.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ifmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ifsutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ifsutilx.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\imaadp32.acm:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\imagehlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\imapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\imapi2.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\imapi2fs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\imgutil.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\imm32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\inetcomm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\inetcpl.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\inetmib1.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\InfDefaultInstall.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\InkEd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\input.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\InputSwitch.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\inseng.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\instnm.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\intl.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ipconfig.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\IPHLPAPI.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iprop.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iprtprio.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iprtrmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ipsecsnp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ipsmsnap.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ir32_32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ir41_32.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ir41_qc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ir41_qcx.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ir50_32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ir50_qc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ir50_qcx.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\irclass.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\irprops.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iscsicli.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iscsicpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iscsicpl.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iscsidsc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iscsied.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iscsium.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iscsiwmi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iscsiwmiv2.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\isoburn.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\itircl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\itss.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\iyuv_32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\joy.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\jscript.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\jscript9.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\jscript9diag.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\jsproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KBDAZE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KBDAZEL.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KBDAZST.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KBDBASH.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\kbdgeoqw.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KBDRU.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KBDRU1.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KBDRUM.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KBDTAT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KBDTT102.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KBDYAK.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\kerberos.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\kernel.appcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\kernel32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KernelBase.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\keyiso.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\keymgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\kmddsp.tsp:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\korwbrkr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ksproxy.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\kstvtune.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ksuser.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Kswdmcap.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ksxbar.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ktmutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ktmw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\l2gpstore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\l2nacp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\L2SecHC.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\l3codeca.acm:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\l3codecp.acm:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\label.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\LAPRXY.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\LaunchTM.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\licmgr10.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\linkinfo.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\loadperf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\localsec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\LocationApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\LocationNotifications.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\lodctr.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\logagent.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\loghours.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\logman.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\logoncli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\lsmproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\luainstall.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Magnification.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Magnify.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\main.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\makecab.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mapistub.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MbaeApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MbaeApiPublic.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mbsmsapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mbussdapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mcbuilder.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mciavi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mcicda.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mciqtz32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mciseq.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mciwave.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mdminst.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mdmregistration.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mf3216.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfAACEnc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfasfsrcsnk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfc42.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfc42u.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MFCaptureEngine.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfcsubs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfds.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfdvdec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfh264enc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MFMediaEngine.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfmjpegdec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfmp4srcsnk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfmpeg2srcsnk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfnetcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfnetsrc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfplat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MFPlay.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfpmp.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfreadwrite.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfsrcsnk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfsvr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mftranscode.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfvdsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MFWMAAEC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mgmtapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mibincodec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Microsoft.Management.Infrastructure.Native.Unmanaged.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MicrosoftAccountTokenProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\midimap.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\migisol.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\miguiresource.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mimefilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mimofcodec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MirrorDrvCompat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mispace.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\miutils.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mlang.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mmc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mmcbase.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mmci.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mmcico.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mmcndmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mmcshext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MMDevAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mmsys.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mobsync.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mode.com:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\modemui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\more.com:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mountvol.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MP3DMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MP43DECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MP4SDECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Mpeg2Data.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mpg2splt.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MPG4DECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mpr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mprapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mprddm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mprdim.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mprext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mprmsg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MRINFO.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MrmCoreR.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MrmIndexer.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mrt100.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mrt_map.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msaatext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSAC3ENC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msacm32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msacm32.drv:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msadp32.acm:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msasn1.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSAudDecMFT.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msaudite.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mscandui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mscat32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mscms.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mscpxl32.dLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msctf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msctfime.ime:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MsCtfMonitor.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msctfp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msctfui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msctfuimanager.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msdadiag.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msdart.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msdelta.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msdmo.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msdrm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msdt.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msdtcprx.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msdtcuiu.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSDvbNP.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msdxm.ocx:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msfeeds.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msfeedsbs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msfeedssync.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msftedit.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msg711.acm:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msgsm32.acm:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mshta.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mshtml.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MshtmlDac.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mshtmled.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msidcrl40.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msident.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msidle.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msieftp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msiexec.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msihnd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msiltcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msimg32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msimtf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msinfo32.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msisip.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msiwer.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mskeyprotcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mskeyprotect.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msls31.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msmpeg2adec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSMPEG2ENC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msmpeg2vdec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msnetobj.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSNP.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msoeacct.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msoert2.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msorcl32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mspaint.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mspatcha.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mspatchc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msports.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msra.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msrating.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msrdc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MsRdpWebAccess.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msrle32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msscntrs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msscp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msscript.ocx:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mssha.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msshooks.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mssign32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mssip32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mssitlb.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MsSpellCheckingFacility.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MsSpellCheckingHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mssph.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mssphtb.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mssprxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mssrch.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mssvp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mstask.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mstsc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mstscax.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msutb.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msv1_0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msvcirt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msvcp60.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msvcr120_clr0400.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msvcrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msvfw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msvidc32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSVidCtl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSVideoDSP.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msvproc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSWB7.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSWB70011.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSWB7001E.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSWB70404.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSWB70804.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mswmdm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mswsock.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msxml3.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msxml6.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msyuv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mtstocom.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mtxclu.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mtxdm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mtxex.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mtxlegih.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mtxoci.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\muifontsetup.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MuiUnattend.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mycomput.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mydocs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Mystify.scr:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\napdsnap.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NapiNSP.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\napipsec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NAPMONTR.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NAPSTAT.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Narrator.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NaturalLanguage6.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NcaApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NcdProp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nci.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ncobjapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ncpa.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ncrypt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ncryptprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ncryptsslp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ndadmin.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nddeapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ndfapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ndfetw.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ndfhcdiscovery.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ndiscapCfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ndishc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ndproxystub.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\negoexts.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\net.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\net1.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netbios.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netbtugc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netcenter.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netcfgx.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netcorehc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netdiagfx.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netid.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netiohlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netiougc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netjoin.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netlogon.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netplwiz.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Netplwiz.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netprofm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netprovisionsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netsh.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netshell.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NETSTAT.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netutils.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\networkexplorer.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\networkitemfactory.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\newdev.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\newdev.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ninput.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NL7Data0011.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NL7Data001E.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NL7Data0404.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NL7Data0804.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nlhtml.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nlmgp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nlmproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nlmsprep.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0000.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0002.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0003.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0007.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0009.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData000a.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData000c.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData000d.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData000f.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0010.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0018.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData001a.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData001b.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData001d.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0020.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0021.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0022.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0024.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0026.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0027.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData002a.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0039.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData003e.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0045.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0046.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0047.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0049.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData004a.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData004b.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData004c.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData004e.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0414.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0416.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0816.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData081a.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsData0c1a.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Nlsdl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NlsLexicons0009.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\normaliz.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\notepad.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\npmproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nshhttp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nshipsec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nshwfp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nsi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nslookup.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntasn1.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntdll.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntdsapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntlanman.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntlanui2.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntmarta.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntprint.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntprint.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntshrui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntvdm64.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvaudcap32v.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvcompiler.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvcuda.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvcuvid.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvd3dum.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvEncodeAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NvFBC.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NvIFR.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\NvIFROpenGL.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvinit.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvoglshim32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvoglv32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvopencl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvStreaming.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvumdshim.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nvwgf2um.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\objsel.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\occache.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ocsetapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbc32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbcad32.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbcbcp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbcconf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbcconf.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbccp32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbccr32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbccu32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbcji32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbcjt32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbctrac.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\oddbse32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odexl32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odfox32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odpdx32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odtext32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\OEMLicense.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\offfilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\offreg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ogldrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ole32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\oleacc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\oleacchooks.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\oleaut32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\olecli32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\oledlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\oleprn.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\olepro32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\olesvr32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\olethk32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\OnDemandConnRouteHelper.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\onex.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\onexui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\OobeFldr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\OpcServices.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\OpenCL.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\openfiles.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\opengl32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\OpenWith.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\osbaseln.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\osk.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\OskSupport.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\osuninst.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\P2P.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\P2PGraph.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\p2pnetsh.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\packager.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PackageStateRoaming.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\panmap.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PATHPING.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pautoenr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pcacli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pcaui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pcaui.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PCPKsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PCPTpm12.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pdh.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pdhui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\perfctrs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\perfdisk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\perfmon.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\perfnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\perfos.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\perfproc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\perfts.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PhotoMetadataHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PhotoScreensaver.scr:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\photowiz.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PickerHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pid.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PING.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PkgMgr.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pku2u.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pla.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\playlistfolder.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PlaySndSrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PlayToDevice.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PlayToManager.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PlayToStatusProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pngfilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pnrpnsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\polstore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\poqexec.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PortableDeviceApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PortableDeviceClassExtension.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PortableDeviceConnectApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PortableDeviceStatus.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PortableDeviceSyncProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PortableDeviceTypes.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PortableDeviceWiaCompat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PortableDeviceWMDRM.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pots.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\powercfg.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\powercfg.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\powercpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\powrprof.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PresentationNative_v0300.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\prevhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\print.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PrintConfig.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PrintDialogs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\printui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\printui.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\prncache.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\prnfldr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\prnntfy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\prntvpt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\profapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\profext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\propsys.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\proquota.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\provcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\provsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\provthrd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ProximityCommon.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ProximityCommonPal.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ProximityRtapiPal.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\prvdmofcomp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\psapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\psisdecd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\psisrndr.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\PSModuleDiscoveryProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\psr.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pstorec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\puiapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\puiobj.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pwrshplugin.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\QAGENT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\qasf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\QCLIPROV.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\qdv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\qdvd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\qedit.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\qmgrprxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\QSHVHOST.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\QSVRMGMT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\quartz.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Query.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\QUTIL.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\qwave.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RacEngn.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\racpldlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\radardt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\radarrs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RADCUI.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasadhlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasautou.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rascfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\raschap.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\raschapext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasctrs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasdiag.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasdial.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasdlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\raserver.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasgcw.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasman.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasmontr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasmxs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasphone.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasplap.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasppp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rasser.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rastapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rastls.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rastlsext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rdpcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rdpencom.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rdpendp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RdpSa.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RdpSaProxy.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RdpSaPs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RdpSaUacHelper.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rdrleakdiag.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rdvidcrl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rdvvmtransport.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ReAgent.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ReAgentc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\recover.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\reg.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\regapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RegCtrl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\regedit.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\regedt32.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\regini.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Register-CimProvider.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\regsvr32.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ReInfo.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rekeywiz.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\relog.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\remotepg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\remotesp.tsp:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RemoveDeviceContextHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RemoveDeviceElevated.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\replace.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RESAMPLEDMO.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\resmon.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RestoreOptIn.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\resutils.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rgb9rast.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Ribbons.scr:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\riched20.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\riched32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RMActivate.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RMActivate_isv.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RMActivate_ssp.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RMActivate_ssp_isv.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RmClient.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rnr20.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Robocopy.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ROUTE.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rpchttp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RpcNs4.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rpcnsh.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RpcPing.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rpcrt4.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RpcRtRemote.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rrinstaller.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rsaenh.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rshx32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RstrtMgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rtffilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rtm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rtutils.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RTWorkQ.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\runas.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rundll32.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RunLegacyCPLElevated.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\runonce.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\samcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\samlib.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sas.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sbe.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sbeio.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\scansetting.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SCardDlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\scecli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\scesrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\schannel.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\schedcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\schtasks.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\scksp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\scripto.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\scrnsave.scr:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\scrobj.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\scrrun.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sdbinst.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sdchange.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sdiageng.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sdiagnhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sdiagprv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sdohlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SearchFilterHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SearchFolder.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SearchIndexer.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SearchProtocolHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SecEdit.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sechost.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\secinit.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\secproc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\secproc_isv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\secproc_ssp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\secproc_ssp_isv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\secur32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sendmail.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SensApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SensorsApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SensorsCpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\serialui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\serwvdrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SessEnv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sethc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SettingMonitor.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SettingSyncCore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SettingSyncHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SettingSyncPolicy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\setup16.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\setupapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\setupcln.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\setupugc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\setx.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sfc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sfc_os.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SHCore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shdocvw.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shell32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shfolder.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shgina.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shimeng.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shimgvw.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shlwapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shpafact.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shrpubw.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shsetup.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shsvcs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shunimpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shutdown.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shwebsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\signdrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SimAuth.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SimCfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sisbkup.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SkyDriveShell.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\slc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\slpts.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SmartcardCredentialProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SmartScreenSettings.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SMBHelperClass.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\smphost.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SndVol.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SndVolSSO.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\snmpapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\softkbd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\softpub.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sort.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SortServer2003Compat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SortWindows61.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SortWindows6Compat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\spbcd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\spfileq.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SPInf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\spnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\spopk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\spp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sppc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\spwinsat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\spwizeng.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\spwmp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sqlcecompact40.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sqlceoledb40.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sqlceqp40.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sqlcese40.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sqlsrv32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sqmapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\srchadmin.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\srclient.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SRH.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\srumapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\srumsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\srvcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sscore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ssdpapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sspicli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SSShim.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ssText3d.scr:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Startupscan.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\stclient.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sti.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\stobject.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\StorageContextHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\storagewmi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\storagewmi_passthru.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Storprop.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\StorSvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\StructuredQuery.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\subst.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sud.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\svchost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sxproxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sxs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sxshared.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sxsstore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sxstrace.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SyncCenter.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\synceng.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SyncHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SyncHostps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SyncInfrastructure.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SyncInfrastructureps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Syncreg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\syncui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sysdm.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\syskey.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sysmon.ocx:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\syssetup.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\systemcpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SystemEventsBrokerClient.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\systeminfo.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SystemPropertiesComputerName.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SystemPropertiesHardware.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SystemPropertiesPerformance.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SystemPropertiesProtection.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\SystemPropertiesRemote.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\systray.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\t2embed.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\takeown.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tapi3.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TapiMigPlugin.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tapiperf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tapisrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TapiSysprep.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TapiUnattend.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\taskcomp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\taskeng.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\taskkill.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tasklist.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Taskmgr.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\taskschd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TaskSchdPS.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tbs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tcmsetup.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tcpipcfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tcpmib.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tcpmonui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TCPSVCS.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tdc.ocx:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tdh.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\telephon.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\termmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\themecpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\themeui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\threadpoolwinrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\thumbcache.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ThumbnailExtractionHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TimeBrokerClient.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\timedate.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TimeDateMUICallback.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\timeout.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tlscsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tpmcompc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TpmInit.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tquery.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tracerpt.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TRACERT.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\traffic.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tree.com:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tsbyuv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TSChannel.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tsgqec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tsmf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TSpkg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TSTheme.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TSWorkspace.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TsWpfWrp.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TtlsAuth.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TtlsCfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TtlsExt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tvratings.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\twext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\twinapi.appcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\twinapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\twinui.appcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\twinui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\txflog.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\txfw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\typeperf.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tzutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ucmhc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ucrtbase.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\udhisapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\uexfat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ufat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\UIAnimation.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\UIAutomationCore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\uicom.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\uireng.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\UIRibbon.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\UIRibbonRes.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ulib.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\umdmxfrm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\unimdm.tsp:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\unimdmat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\uniplat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\unlodctr.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\unregmp2.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\untfs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\upnp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\upnpcont.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\upnphost.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ureg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\url.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\urlmon.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\usbceip.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\usbperf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\usbui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\user.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\user32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\UserAccountBroker.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\UserAccountControlSettings.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\UserAccountControlSettings.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\usercpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\userenv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\userinit.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\userinitext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\UserLanguageProfileCallback.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\UserLanguagesCpl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\usp10.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ustprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\utildll.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Utilman.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\uudf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\UXInit.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\uxlib.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\uxtheme.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\VAN.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Vault.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vaultcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\VBICodec.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vbisurf.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vbscript.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vdmdbg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vds_ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\verclsid.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\verifier.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\verifier.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\version.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vfwwdm32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vidcap.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\VIDRESZR.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\virtdisk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vmnat.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vmnetdhcp.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vpnikeapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\VscMgrPS.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vssadmin.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vssapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vsstrace.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\vss_ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\w32tm.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\w32topl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WABSyncProvider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\waitfor.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wavemsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wbemcomn.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wcmapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WcnApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wcnwiz.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WcsPlugInService.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wdc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wdi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wdigest.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wdmaud.drv:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wdscore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WebcamUi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\webcheck.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WebClnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\webio.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\webservices.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Websocket.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wecapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wecutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wer.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\werdiagcontroller.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WerFault.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WerFaultSecure.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wermgr.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\werui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wevtapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wevtfwd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wevtutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wextract.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wfapigp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wfdprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WfHC.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\where.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\whhelper.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\whoami.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wiaacmgr.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wiaaut.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wiadefui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wiadss.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wiascanprofiles.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wiashext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wiatrace.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wimgapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winbio.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winbrand.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wincorlib.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wincredprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.ApplicationModel.Background.SystemEventsBroker.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.ApplicationModel.Background.TimeBroker.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.ApplicationModel.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Data.Pdf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Background.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Background.ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Bluetooth.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Custom.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Custom.ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Enumeration.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Enumeration.ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Geolocation.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.PointOfService.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Portable.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Printers.Extensions.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Scanners.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Sensors.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.SmartCards.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.Usb.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Devices.WiFiDirect.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Globalization.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Globalization.Fontgroups.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Graphics.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Graphics.Printing.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Management.Workplace.WorkplaceSettings.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Media.Devices.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Media.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Media.MediaControl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Media.SpeechSynthesis.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Media.Streaming.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Media.Streaming.ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Networking.Connectivity.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Networking.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Networking.HostName.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Networking.NetworkOperators.HotspotAuthentication.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Networking.Proximity.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Networking.Sockets.PushEnabledApplication.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Security.Authentication.OnlineId.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Security.Credentials.UI.CredentialPicker.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Security.Credentials.UI.UserConsentVerifier.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Shell.Search.UriHandler.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Storage.ApplicationData.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Storage.Compression.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.System.Display.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.System.Profile.HardwareId.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.System.Profile.SystemManufacturers.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.System.RemoteDesktop.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.Search.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.UI.Xaml.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Web.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Windows.Web.Http.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WindowsCodecs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WindowsCodecsExt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\windowslivelogin.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WinFax.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winhttp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wininet.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wininitext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winipsec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Winlangdb.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winmde.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winmm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winmmbase.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WinMsoIrmProtector.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winnsi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WinOpcIrmProtector.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winrnr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winrs.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winrscmd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winrshost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winrssrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WinRtTracing.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WinSATAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WinSCard.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winsku.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winsockhc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winspool.drv:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WINSRPC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winsta.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WinSync.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WinSyncMetastore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WinSyncProviders.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wintrust.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WinTypes.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winusb.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winver.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wisp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wkscli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wkspbrokerAx.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wksprtPS.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlanapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlancfg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WLanConn.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlandlg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlanext.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlangpui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlanhlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlaninst.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WlanMM.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlanmsm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlanpref.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlansec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlanui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Wldap32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlgpclnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlidcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlidcredprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlidfdp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlidnsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wlidprov.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WlS0WndH.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMADMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMADMOE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMASF.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmcodecdspps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmdmlog.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmdmps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmdrmdev.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmdrmnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmdrmsdk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmiclnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmidcom.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmidx.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmiprop.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmitomi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMNetMgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMPDMC.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WmpDui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmpdxm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmpeffects.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMPhoto.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmpps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmpshell.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmsgapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMSPDMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMSPDMOE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMVCORE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMVDECOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmvdspa.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMVENCOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMVSDECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMVSENCD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMVXENCD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WorkFoldersRes.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wow32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wowreg32.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\Wpc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wpcsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wpdshext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WPDShextAutoplay.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WPDShServiceObj.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WPDSp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wpnapps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\write.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ws2help.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ws2_32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wscapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wscinterop.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wscisvif.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WSClient.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wscproxystub.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wscript.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wscui.cpl:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WSDApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wsdchngr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wsecedit.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wshbth.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wshcon.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wshelper.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wshext.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wship6.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wshirda.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wshom.ocx:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wshqos.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wshrm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WSHTCPIP.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WsmAgent.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WSManHTTPConfig.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WSManMigrationPlugin.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WsmAuto.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wsmplpxy.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wsmprovhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WsmSvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WsmWmiPl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wsnmp32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wsock32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WSShared.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WSSync.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WSTPager.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wtsapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wuapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wuapp.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wudriver.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wups.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wusa.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wuwebv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WwaApi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WWAHost.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WWanAPI.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wwapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_8.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xcopy.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\XInput1_4.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\XInput9_1_0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xmlfilter.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xmllite.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xmlprovi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xolehlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\XpsFilt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\XpsGdiConverter.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\XpsPrint.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\XpsRasterService.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xpsrchvw.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xpsservices.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\XPSSHHDR.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xpssvcs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xwizard.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xwizards.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xwreg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xwtpdui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\xwtpw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\zipfldr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\acpi.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\afd.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\agilevpn.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ahcache.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\appid.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\avgntflt.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\avnetflt.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\BasicRender.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\bridge.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\BtaMPM.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\bthhfenum.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\Classpnp.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\clfs.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\cng.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\dam.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\dfsc.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\drmk.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\drmkaud.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\dumpfve.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\dumpsd.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\dxgkrnl.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\dxgmms1.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\fileinfo.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\fltMgr.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\fsdepends.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\fvevol.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\FWPKCLNT.SYS:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\hdaudbus.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\hidbth.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\hidclass.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\hidusb.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\i8042prt.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\intelpep.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\IPMIDrv.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ipnat.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\kbdclass.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\kbdhid.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ks.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ksecdd.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ksecpkg.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\luafv.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mouclass.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mouhid.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mountmgr.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mpsdrv.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mrxdav.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb10.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb20.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\msgpioclx.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\msiscsi.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mslldp.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ndis.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ndiscap.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\NdisImPlatform.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ndistapi.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ndproxy.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\Ndu.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\netbios.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\netio.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\netvsc63.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\nsiproxy.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ntfs.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\nvhda64v.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\nvlddmkm.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\nvvad64v.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\nwifi.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\pacer.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\partmgr.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\pci.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\pdc.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\PEAuth.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\portcls.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\qwavedrv.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\rasacd.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\rasl2tp.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\rassstp.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\rdbss.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\rdpvideominiport.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\rdyboost.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\refs.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\rmcast.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\rootmdm.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\scfilter.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\sdbus.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\sdstor.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\SerCx2.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\sermouse.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\spaceport.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\srv.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\srv2.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\srvnet.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\stornvme.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\storport.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\swenum.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\tbs.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\tcpip.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\tcpipreg.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\tdx.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\tpm.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\TsUsbGD.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\tunnel.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\UCX01000.SYS:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\udfs.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usb8023.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbccgp.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbcir.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbd.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbehci.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbhub.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\USBHUB3.SYS:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbohci.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbport.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbscan.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\USBSTOR.SYS:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbuhci.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\USBXHCI.SYS:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\VerifierExt.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\vhdmp.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\vmbkmcl.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\vmbus.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\vmci.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\vmnetadapter.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\vmnetbridge.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\vmstorfl.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\volsnap.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\vpci.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\wanarp.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\watchdog.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\wfplwfs.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\wimmount.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\winhv.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\wof.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\wpcfltr.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\WUDFPf.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\WUDFRd.sys:$CmdTcID AlternateDataStreams: C:\Users\phil\Desktop\adwcleaner_5.026.exe:$CmdTcID AlternateDataStreams: C:\Users\phil\Desktop\adwcleaner_5.026.exe:$CmdZnID AlternateDataStreams: C:\Users\phil\Desktop\ashampoo_burning_studio_free_1.14.5_sm.exe:$CmdTcID AlternateDataStreams: C:\Users\phil\Desktop\ashampoo_burning_studio_free_1.14.5_sm.exe:$CmdZnID AlternateDataStreams: C:\Users\phil\Desktop\audacity-win-2.0.5.exe:$CmdTcID AlternateDataStreams: C:\Users\phil\Desktop\audacity-win-2.0.5.exe:$CmdZnID AlternateDataStreams: C:\Users\phil\Desktop\captvty-2.3.6.zip:$CmdTcID AlternateDataStreams: C:\Users\phil\Desktop\captvty-2.3.6.zip:$CmdZnID AlternateDataStreams: C:\Users\phil\Desktop\demarrage vm.bat:$CmdTcID AlternateDataStreams: C:\Users\phil\Desktop\FreemakeVideoConverterSetup.exe:$CmdTcID AlternateDataStreams: C:\Users\phil\Desktop\FreemakeVideoConverterSetup.exe:$CmdZnID AlternateDataStreams: C:\Users\phil\Desktop\FRST64.exe:$CmdZnID AlternateDataStreams: C:\Users\phil\Desktop\Installer-ProRealTime-win64.exe:$CmdTcID AlternateDataStreams: C:\Users\phil\Desktop\Installer-ProRealTime-win64.exe:$CmdZnID AlternateDataStreams: C:\Users\phil\Desktop\mbam-setup-2.2.0.1024.exe:$CmdTcID AlternateDataStreams: C:\Users\phil\Desktop\mbam-setup-2.2.0.1024.exe:$CmdZnID AlternateDataStreams: C:\Users\phil\Desktop\RevoUninProSetup.exe:$CmdTcID AlternateDataStreams: C:\Users\phil\Desktop\RevoUninProSetup.exe:$CmdZnID AlternateDataStreams: C:\Users\phil\Desktop\torbrowser-install-3.6.2_fr.exe:$CmdTcID AlternateDataStreams: C:\Users\phil\Desktop\torbrowser-install-3.6.2_fr.exe:$CmdZnID ==================== Mode sans échec (Avec liste blanche) =================== (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le "AlternateShell" sera restauré.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DFServ => ""="Service" ==================== EXE Association (Avec liste blanche) =============== (Si un élément est inclus dans le fichier fixlist.txt, l'élément de Registre sera restauré à la valeur par défaut ou supprimé.) ==================== Internet Explorer sites de confiance/sensibles =============== (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre.) ==================== Hosts contenu: =============================== (Si nécessaire, la commande Hosts: peut être incluse dans le fichier fixlist.txt afin de réinitialiser le fichier hosts.) 2015-10-20 02:34 - 2014-04-11 07:58 - 00000864 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 activation.cloud.techsmith.com ==================== Autres zones ============================ (Actuellement, il n'y a pas de correction automatique pour cette section.) HKU\S-1-5-21-1829065414-1029609543-2641321589-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg DNS Servers: 109.88.203.3 - 62.197.111.140 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Le Pare-feu est activé. ==================== MSCONFIG/TASK MANAGER éléments désactivés == (Actuellement, il n'y a pas de correction automatique pour cette section.) HKLM\...\StartupApproved\StartupFolder: => "HP Digital Imaging Monitor.lnk" HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched" HKLM\...\StartupApproved\Run32: => "HP Software Update" ==================== RèglesPare-feu (Avec liste blanche) =============== (Si un élément est inclus dans le fichier fixlist.txt, il sera supprimé du Registre. Le fichier ne sera pas déplacé, sauf s'il est inscrit séparément.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [TCP Query User{5C037046-DE28-4DFA-BE65-A1CD392834A5}C:\program files (x86)\flashget network\flashget 3\flashget3.exe] => (Allow) C:\program files (x86)\flashget network\flashget 3\flashget3.exe FirewallRules: [UDP Query User{35D89B72-1BD7-45A5-8B4C-12109FFB098D}C:\program files (x86)\flashget network\flashget 3\flashget3.exe] => (Allow) C:\program files (x86)\flashget network\flashget 3\flashget3.exe FirewallRules: [{9B877D0A-91DE-4E54-BEC2-FB06CEF18F1E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{5E656106-D212-4E2C-BDF4-80D02E2DFDBB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{B6410495-9F94-4CC9-829D-DFDC8761E408}] => (Allow) LPort=8317 FirewallRules: [{C60F9BB4-FDEB-4F27-BC5D-B428568287AB}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe FirewallRules: [{3534F4B6-E45C-4374-85C1-3A145966BAF0}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe FirewallRules: [{F303AE5A-ED61-49D3-8CAC-9E1C20080E6C}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe FirewallRules: [{8B07C48A-581F-409B-AB01-5726306AED0D}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe FirewallRules: [{3A2E5F48-89FF-451F-954A-C2C91DC53CE8}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe FirewallRules: [{C72FD40D-0690-4613-B6C3-E557337F71C5}] => (Allow) C:\Program Files\DriversCloud.com\MCDetection.exe FirewallRules: [{2102DF7A-2258-4A35-88E5-BD4734E08070}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe FirewallRules: [{F3DD152E-F610-4707-97BB-2B138DC56FE3}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe FirewallRules: [{69E88651-20B2-4B3D-918B-5EED2BA77531}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe FirewallRules: [{13218E49-7639-4A11-A1E2-B354BB4141DF}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe FirewallRules: [{8E7F9EB4-3243-4213-9895-E2190CB7FB4D}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe FirewallRules: [{EFC09AFB-C877-40A1-B984-917A52468294}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe FirewallRules: [{2CC52F0B-A118-4FE5-A3E4-F6AAF4A985B0}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe FirewallRules: [{60E23364-0B19-4F66-AC70-1D74E4801356}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe FirewallRules: [{F273C8D2-43E1-4B5A-99D9-F392684ECE54}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe FirewallRules: [{850D8D0A-7A25-490C-BCF9-04079ABE5930}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe FirewallRules: [{2D4AD346-BDDB-4ABC-BA16-093D30A09978}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe FirewallRules: [{5D7BD314-6224-491F-90B3-A72E8AB55239}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe FirewallRules: [{66A00925-09C2-4D0D-9734-138A1EA2E331}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe FirewallRules: [{F6E89E26-2509-4FBA-806D-01E2CFEC6A8C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe FirewallRules: [{13495EDC-01FC-453B-908E-14F9F6023DD3}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe FirewallRules: [{829CDC10-2ABE-4901-99AC-22C234D16945}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{0BD0B4FE-0126-4B8A-87B8-CC56D6A65E0A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{A2096C43-F1EE-4EE9-A9CF-BA771ACCDA41}] => (Allow) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe FirewallRules: [{FA53531C-A805-4F99-AFFF-53035A21C8EB}] => (Allow) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe FirewallRules: [{42EBDE0F-98F8-4860-BBE0-FB39ACF4063B}] => (Allow) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe FirewallRules: [{B842E761-3D58-4D27-A2EC-DD9415AFDC65}] => (Allow) C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DFServ.exe FirewallRules: [TCP Query User{4463DAA9-EF87-4101-AAF0-35218CA50417}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe FirewallRules: [UDP Query User{A7F5A393-BC72-485E-A7D3-0C125DCFE724}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe] => Enabled:Flashget3 ==================== Points de restauration ========================= ==================== Éléments en erreur du Gestionnaire de périphériques ============= ==================== Erreurs du Journal des événements: ========================= Erreurs Application: ================== Error: (02/03/2016 03:36:41 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nom de l’application défaillante regsvr32.exe, version : 6.3.9600.17415, horodatage : 0x54505249 Nom du module défaillant : unknown, version : 0.0.0.0, horodatage : 0x00000000 Code d’exception : 0xc0000005 Décalage d’erreur : 0x0000000180c580ac ID du processus défaillant : 0x408 Heure de début de l’application défaillante : 0xregsvr32.exe0 Chemin d’accès de l’application défaillante : regsvr32.exe1 Chemin d’accès du module défaillant: regsvr32.exe2 ID de rapport : regsvr32.exe3 Nom complet du package défaillant : regsvr32.exe4 ID de l’application relative au package défaillant : regsvr32.exe5 Error: (02/02/2016 03:31:40 PM) (Source: System Restore) (EventID: 8193) (User: ) Description: Échec de la création d’un point de restauration (Processus = C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe -Embedding ; Description = Programme d’installation pour les modules Windows ; Erreur = 0x80070422). Error: (02/02/2016 02:31:50 PM) (Source: System Restore) (EventID: 8193) (User: ) Description: Échec de la création d’un point de restauration (Processus = C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe -Embedding ; Description = Programme d’installation pour les modules Windows ; Erreur = 0x80070422). Error: (02/02/2016 02:31:50 PM) (Source: System Restore) (EventID: 8193) (User: ) Description: Échec de la création d’un point de restauration (Processus = C:\Windows\system32\lpksetup.exe -Embedding ; Description = Suppression du module linguistique ; Erreur = 0x80070422). Error: (02/02/2016 06:26:04 AM) (Source: System Restore) (EventID: 8193) (User: ) Description: Échec de la création d’un point de restauration (Processus = C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe -Embedding ; Description = Programme d’installation pour les modules Windows ; Erreur = 0x80070422). Error: (01/21/2016 09:36:50 AM) (Source: System Restore) (EventID: 8193) (User: ) Description: Échec de la création d’un point de restauration (Processus = C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe -Embedding ; Description = Programme d’installation pour les modules Windows ; Erreur = 0x80070422). Error: (01/21/2016 09:36:46 AM) (Source: System Restore) (EventID: 8193) (User: ) Description: Échec de la création d’un point de restauration (Processus = C:\Windows\system32\svchost.exe -k netsvcs ; Description = Windows Update ; Erreur = 0x80070422). Error: (01/14/2016 09:18:58 AM) (Source: System Restore) (EventID: 8193) (User: ) Description: Échec de la création d’un point de restauration (Processus = C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe -Embedding ; Description = Programme d’installation pour les modules Windows ; Erreur = 0x80070422). Error: (01/14/2016 09:09:02 AM) (Source: System Restore) (EventID: 8193) (User: ) Description: Échec de la création d’un point de restauration (Processus = C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe -Embedding ; Description = Programme d’installation pour les modules Windows ; Erreur = 0x80070422). Error: (01/14/2016 08:59:07 AM) (Source: System Restore) (EventID: 8193) (User: ) Description: Échec de la création d’un point de restauration (Processus = C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe -Embedding ; Description = Programme d’installation pour les modules Windows ; Erreur = 0x80070422). Erreurs système: ============= Error: (02/14/2016 04:21:26 PM) (Source: DCOM) (EventID: 10010) (User: flexi2202) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (02/14/2016 04:20:51 PM) (Source: DCOM) (EventID: 10010) (User: flexi2202) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (02/14/2016 04:20:25 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: AUTORITE NT) Description: 0x8000002a42\SystemRoot\System32\Config\RegBack\SYSTEM Error: (02/14/2016 04:09:45 PM) (Source: cdrom) (EventID: 11) (User: ) Description: Le pilote a détecté une erreur du contrôleur sur \Device\CdRom0. Error: (02/03/2016 03:42:26 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: Le service Superfetch s’est arrêté avec l’erreur : %%1062 Error: (02/02/2016 01:30:47 PM) (Source: DCOM) (EventID: 10010) (User: flexi2202) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (02/02/2016 01:30:17 PM) (Source: DCOM) (EventID: 10010) (User: flexi2202) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (02/02/2016 01:30:03 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: AUTORITE NT) Description: 0x8000002a42\SystemRoot\System32\Config\RegBack\SYSTEM Error: (02/02/2016 12:10:01 PM) (Source: DCOM) (EventID: 10010) (User: flexi2202) Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39} Error: (01/14/2016 07:57:49 AM) (Source: DCOM) (EventID: 10010) (User: flexi2202) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} CodeIntegrity: =================================== Date: 2016-02-14 16:09:30.831 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-02-09 06:33:51.796 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-02-09 06:27:01.831 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-02-09 06:19:05.651 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-02-09 06:05:45.925 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-02-03 15:38:15.228 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-02-03 15:31:43.937 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-02-02 17:19:43.113 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-02-02 17:11:18.540 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-02-02 13:18:58.875 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. ==================== Infos Mémoire =========================== Processeur: Intel(R) Pentium(R) CPU G3220 @ 3.00GHz Pourcentage de mémoire utilisée: 34% Mémoire physique - RAM - totale: 4048.72 MB Mémoire physique - RAM - disponible: 2666.86 MB Mémoire virtuelle totale: 8144.72 MB Mémoire virtuelle disponible: 6244.43 MB ==================== Lecteurs ================================ Drive c: () (Fixed) (Total:124.13 GB) (Free:86.31 GB) NTFS Drive d: (Nouveau nom) (Fixed) (Total:341.24 GB) (Free:83.72 GB) NTFS Drive e: (formation) (Fixed) (Total:465.76 GB) (Free:151.87 GB) NTFS ==================== MBR & Table des partitions ================== ======================================================== Disk: 0 (Size: 465.8 GB) (Disk ID: B81D482A) Partition: GPT. ======================================================== Disk: 1 (Size: 465.8 GB) (Disk ID: DFF40713) Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS) ==================== Fin de Addition.txt ============================