Rezultaty skanu uzupełniającego Farbar Recovery Scan Tool (x64) Wersja:09-12-2015 Uruchomiony przez Patryk_2 (2015-12-11 14:54:44) Uruchomiony z C:\Users\Patryk_2\Desktop Windows 8.1 (X64) (2013-12-14 18:34:15) Tryb startu: Normal ========================================================== ==================== Konta użytkowników: ============================= Administrator (S-1-5-21-3680470863-837635135-2748872348-500 - Administrator - Disabled) => C:\Users\Administrator Gość (S-1-5-21-3680470863-837635135-2748872348-501 - Limited - Enabled) => C:\Users\Gość Patryk_2 (S-1-5-21-3680470863-837635135-2748872348-1009 - Administrator - Enabled) => C:\Users\Patryk_2 PW (S-1-5-21-3680470863-837635135-2748872348-1008 - Administrator - Enabled) => C:\Users\PW ==================== Centrum zabezpieczeń ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Comodo Defense+ (Enabled - Up to date) {493CE176-EB84-BC8D-9707-B3ACF7598648} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} FW: COMODO Firewall (Enabled) {CA6681B7-87D1-B25B-86E8-21EB720D8B8E} ==================== Zainstalowane programy ====================== (W fixlist dozwolone tylko załączanie programów adware z flagą "Hidden" w celu ich uwidocznienia. Programy adware powinny zostać w poprawny sposób odinstalowane.) 7-Zip 9.22beta (HKLM-x32\...\7-Zip) (Version: - ) Adobe Acrobat Reader DC - Polish (HKLM-x32\...\{AC76BA86-7AD7-1045-7B44-AC0F074E4100}) (Version: 15.009.20079 - Adobe Systems Incorporated) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 19.0.0.213 - Adobe Systems Incorporated) Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.235 - Adobe Systems Incorporated) Adobe Flash Player 20 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 20.0.0.228 - Adobe Systems Incorporated) Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.7.157 - Adobe Systems, Inc.) Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden AIMP3 (HKLM-x32\...\AIMP3) (Version: v3.55.1345, 26.03.2014 - AIMP DevTeam) ALLPlayer Pilot (HKLM-x32\...\{146BDBDD-ACD9-4B04-A286-C27471841E8E}_is1) (Version: 1.1 - ALLPlayer Group, Ltd.) Android SDK Tools (HKLM-x32\...\Android SDK Tools) (Version: 1.16 - Google Inc.) Android Studio (HKLM\...\Android Studio) (Version: 1.0 - Google Inc.) Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Application Insights Tools for Visual Studio 2015 (x32 Version: 3.3 - Microsoft Corporation) Hidden Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.7 - Atheros Communications Inc.) Avast Free Antivirus (HKLM-x32\...\avast) (Version: 10.2.2218 - AVAST Software) Azure AD Authentication Connected Service (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden AzureTools.Notifications (x32 Version: 2.7.30611.1601 - Microsoft Corporation) Hidden Batman Arkham Asylum (HKLM-x32\...\{0559F6E9-87B2-4208-94B9-0200866610C7}) (Version: 1.1 - Eidos Interactive) Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment) BitTorrent (HKU\S-1-5-21-3680470863-837635135-2748872348-1009\...\BitTorrent) (Version: 7.9.5.41203 - BitTorrent Inc.) Blend for Visual Studio SDK for .NET 4.5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden Blood Bowl: Legendary Edition (HKLM-x32\...\Steam App 58520) (Version: - Cyanide Studios) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) CamStudio 2.7.2 (HKLM\...\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.2 - CamStudio Open Source) CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform) ChomikBox (HKLM-x32\...\{26050F54-3928-4D9C-849A-C48A9E831E6F}) (Version: 2.0.5.0 - Chomikuj.pl) CodeBlocks (HKU\S-1-5-21-3680470863-837635135-2748872348-1009\...\CodeBlocks) (Version: 10.05 - The Code::Blocks Team) COMODO Internet Security (HKLM\...\{BCC0552D-76C0-4130-BFBD-49BE49ACC594}) (Version: 6.0.2566.2708 - COMODO Security Solutions Inc.) Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.44.50 - Conexant) Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve) Crysis® 2 (HKLM-x32\...\{6033673D-2530-4587-8AD0-EB059FC263F9}) (Version: 1.0.0.0 - Electronic Arts) Curse (HKLM-x32\...\{DEE70742-F4E9-44CA-B2B9-EE95DCF37295}) (Version: 6.0.0.0 - Curse) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.8000.16 - Dolby Laboratories Inc) Dotfuscator and Analytics Community Edition 5.18.1 (x32 Version: 5.18.1.2898 - PreEmptive Solutions) Hidden Dragon Age: Origins (HKLM-x32\...\{AEC81925-9C76-4707-84A9-40696C613ED3}) (Version: 1.05.0.0 - Electronic Arts) Dziobas Rar Player 0.009.52 (HKLM-x32\...\Dziobas Rar Player_is1) (Version: - Kamil Dzióbek) e-Deklaracje Desktop (HKLM-x32\...\e-Deklaracje.A1909296681C7ACEFE45687D3A64758C8659BF46.1) (Version: 5.0.1 - Ministerstwo Finansow) e-Deklaracje Desktop (x32 Version: 5.0.1 - Ministerstwo Finansow) Hidden Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 8.0.2.4 - Lenovo) Energy Management (x32 Version: 8.0.2.4 - Lenovo) Hidden Entity Framework 6.1.3 Tools for Visual Studio 2015 (HKLM-x32\...\{1A8A9739-BAD7-491F-B5B9-A79A2B965422}) (Version: 14.0.40302.0 - Microsoft Corporation) f.lux (HKU\S-1-5-21-3680470863-837635135-2748872348-1009\...\Flux) (Version: - ) Fallout 3 (HKLM-x32\...\{974C4B12-4D02-4879-85E0-61C95CC63E9E}) (Version: 1.00.0000 - Bethesda Softworks) Farm Mania (HKLM-x32\...\Farm Mania1.0) (Version: 1.0 - Adnan_Boy 2008) FCE & CAE Course, Vocabulary Trainer (HKLM-x32\...\FCECAECourse_is1) (Version: - ) Fences (Version: 1.0 - Stardock Corporation) Hidden FIFA 13 (HKLM-x32\...\{A29E18C2-7AB1-4b6b-848C-5D5E2C85F0C0}) (Version: 1.8.0.0 - Electronic Arts) FileZilla Client 3.10.2 (HKLM-x32\...\FileZilla Client) (Version: 3.10.2 - Tim Kosse) Galeria fotografii (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Gems of War (HKLM-x32\...\Steam App 329110) (Version: - Infinity Plus 2) Ghost Recon Advanced Warfighter (HKLM-x32\...\{D867D5F2-C2D1-406F-B9E4-D4D2BFB7AA0D}) (Version: 1.35 - Ubisoft) GIMP 2.8.4 (HKLM\...\GIMP-2_is1) (Version: 2.8.4 - The GIMP Team) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.80 - Google Inc.) Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden Guitar Pro 5.2 (HKLM-x32\...\Guitar Pro 5_is1) (Version: - Arobas Music) Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment) Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version: - Blizzard Entertainment) Huawei E3372 (HKLM-x32\...\Huawei E3372) (Version: 22.001.22.03.1202 - Huawei Technologies Co.,Ltd) I Am Alive (HKLM-x32\...\InstallShield_{62952508-8C6F-4D31-9802-099FC67B41C3}) (Version: 1.01.0 - Ubisoft) I Am Alive (x32 Version: 1.01.0 - Ubisoft) Hidden IIS 10.0 Express (HKLM\...\{5984D8DA-C1AF-4284-9C88-D7150425B315}) (Version: 10.0.1734 - Microsoft Corporation) IIS Express Application Compatibility Database for x64 (HKLM\...\{08274920-8908-45c2-9258-8ad67ff77b09}.sdb) (Version: - ) IIS Express Application Compatibility Database for x86 (HKLM\...\{ad846bae-d44b-4722-abad-f7420e08bcd9}.sdb) (Version: - ) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation) Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation) ipla 2.8.4 (HKLM-x32\...\ipla) (Version: 2.8.4 - Redefine Sp z o.o.) iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.) Jade Empire (HKLM-x32\...\{EEAA7AC3-F651-4842-86E0-4C755181388B}) (Version: 1.0.1.1 - Electronic Arts) Java 7 Update 75 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417075FF}) (Version: 7.0.750 - Oracle) Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation) Java 8 Update 40 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418040F0}) (Version: 8.0.400 - Oracle Corporation) Java SE Development Kit 7 Update 75 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170750}) (Version: 1.7.0.750 - Oracle) King Arthur II - The Role-playing Wargame (HKLM-x32\...\Steam App 24480) (Version: - NeocoreGames) K-Lite Codec Pack 10.4.5 Basic (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.4.5 - ) Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.1.7600.167 - Realtek Semiconductor Corp.) Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.0710 - CyberLink Corp.) Lenovo OneKey Recovery (Version: 8.0.0.0710 - CyberLink Corp.) Hidden Lenovo pointing device (HKLM\...\Elantech) (Version: 11.4.3.3 - ELAN Microelectronic Corp.) Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4310.52 - CyberLink Corp.) Lenovo PowerDVD10 (x32 Version: 10.0.4310.52 - CyberLink Corp.) Hidden Lenovo Solution Center (HKLM\...\{1CA74803-5CB2-4C03-BDBE-061EDC81CC7F}) (Version: 2.8.004.00 - Lenovo Group Limited) Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.1.3127 - CyberLink Corp.) Lenovo YouCam (x32 Version: 4.1.3127 - CyberLink Corp.) Hidden Lexmark X1100 Series (HKLM\...\Lexmark X1100 Series) (Version: - Lexmark International, Inc.) LibreOffice 4.4.6.3 (HKLM-x32\...\{1013DB12-EC2E-455E-B5ED-BFD056DC1A99}) (Version: 4.4.6.3 - The Document Foundation) Logitech Gaming Software 8.70 (HKLM\...\Logitech Gaming Software) (Version: 8.70.315 - Logitech Inc.) Madden NFL 08 (HKLM-x32\...\{A3BC1DBD-64D6-4EBC-0091-24C811662D40}) (Version: - Electronic Arts) Mass Effect (HKLM-x32\...\Steam App 17460) (Version: - BioWare) Metric Collection SDK 35 (x32 Version: 1.2.0010.00 - Lenovo Group Limited) Hidden Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU) (HKLM-x32\...\{D3517C62-68A5-37CF-92F7-93C029A89681}) (Version: 4.5.50932 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (ENU) (HKLM-x32\...\{290FC320-2F5A-329E-8840-C4193BD7A9EE}) (Version: 4.5.51209 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (HKLM-x32\...\{B941AFB4-8851-33A1-9E72-0C33D463C41C}) (Version: 4.5.51209 - Microsoft Corporation) Microsoft .NET Framework 4.6 SDK (HKLM-x32\...\{B5915D37-0637-4A26-A3AA-C5DC9F856370}) (Version: 4.6.00081 - Microsoft Corporation) Microsoft .NET Framework 4.6 Targeting Pack (ENU) (HKLM-x32\...\{3D3CEBE6-40EA-4C48-97FD-73828281AB4A}) (Version: 4.6.00081 - Microsoft Corporation) Microsoft .NET Framework 4.6 Targeting Pack (HKLM-x32\...\{2CC6A4A7-AAC2-46C9-9DBB-3727B5954F65}) (Version: 4.6.00081 - Microsoft Corporation) Microsoft .NET Version Manager (x64) 1.0.0-beta5 (HKLM\...\{c5a4aba3-1aba-3ef8-b2d5-c3fa37f59738}) (Version: 1.0.10609.0 - Microsoft Corporation) Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}) (Version: 1.2.0241 - Microsoft Corporation) Microsoft Help Viewer 2.2 (HKLM-x32\...\Microsoft Help Viewer 2.2) (Version: 2.2.23107 - Microsoft Corporation) Microsoft Office 365 - pl-pl (HKLM\...\O365HomePremRetail - pl-pl) (Version: 15.0.4719.1002 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft SQL Server 2012 Command Line Utilities (HKLM\...\{9D573E71-1077-4C7E-B4DB-4E22A5D2B48B}) (Version: 11.0.2100.60 - Microsoft Corporation) Microsoft SQL Server 2012 Native Client (HKLM\...\{49D665A2-4C2A-476E-9AB8-FCC425F526FC}) (Version: 11.0.2100.60 - Microsoft Corporation) Microsoft SQL Server 2014 Management Objects (HKLM-x32\...\{2774595F-BC2A-4B12-A25B-0C37A37049B0}) (Version: 12.0.2000.8 - Microsoft Corporation) Microsoft SQL Server 2014 Management Objects (x64) (HKLM\...\{1F9EB3B6-AED7-4AA7-B8F1-8E314B74B2A5}) (Version: 12.0.2000.8 - Microsoft Corporation) Microsoft SQL Server 2014 Transact-SQL ScriptDom (HKLM\...\{020CDFE0-C127-4047-B571-37C82396B662}) (Version: 12.0.2000.8 - Microsoft Corporation) Microsoft SQL Server 2014 T-SQL Language Service (HKLM-x32\...\{47D08E7A-92A1-489B-B0BF-415516497BCE}) (Version: 12.0.2000.8 - Microsoft Corporation) Microsoft SQL Server Compact 4.0 SP1 x64 ENU (HKLM\...\{78909610-D229-459C-A936-25D92283D3FD}) (Version: 4.0.8876.1 - Microsoft Corporation) Microsoft SQL Server Data Tools - enu (14.0.50616.0) (HKLM-x32\...\{58246C80-3941-4B69-AE31-264644E2ADB8}) (Version: 14.0.50616.0 - Microsoft Corporation) Microsoft System CLR Types for SQL Server 2014 (HKLM\...\{68BA34E8-9B9D-4A74-83F0-7D366B532D75}) (Version: 12.0.2402.11 - Microsoft Corporation) Microsoft System CLR Types for SQL Server 2014 (HKLM-x32\...\{718FFB65-F6E4-4D62-861F-ED10ED32C936}) (Version: 12.0.2402.11 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{052bac4a-6f79-46d4-a024-1ce1b4f73cd4}) (Version: 8.0.58299 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{f45b48a7-f616-4211-b927-17cab6a96613}) (Version: 8.0.58298 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation) Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) Microsoft Visual Studio Community 2015 (HKLM-x32\...\{50b32652-69d2-4b93-9316-edcd12067b8b}) (Version: 14.0.23107.10 - Microsoft Corporation) Microsoft Web Deploy 3.6 (HKLM\...\{ED4CC1E5-043E-4157-8452-B5E533FE2BA1}) (Version: 3.1238.1955 - Microsoft Corporation) MiKTeX 2.9 (HKLM\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org) Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 23.009.05.00.69 - Huawei Technologies Co.,Ltd) Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.3.0 - Mozilla) Mozilla Thunderbird 31.3.0 (x86 pl) (HKLM-x32\...\Mozilla Thunderbird 31.3.0 (x86 pl)) (Version: 31.3.0 - Mozilla) Multi-Device Hybrid Apps using C# - Templates - ENU (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden NapiProjekt (2.2.0.2399) (HKLM-x32\...\NapiProjekt_is1) (Version: - ) NBA 2K12 (HKLM-x32\...\{04E9B02B-4F85-4B73-B865-27B9B8B35877}) (Version: 1.0.0 - 2K Sports) Nero 9 Essentials (HKLM-x32\...\{3bc77f15-8406-4b68-b1b5-819692186581}) (Version: - Nero AG) Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.5 - Notepad++ Team) NVIDIA PhysX (HKLM-x32\...\{64467D47-FFE4-4FBC-ABBA-A0DB829A17EB}) (Version: 9.12.0613 - NVIDIA Corporation) Obsługa programów Apple (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.) Odlotowa farma (HKLM-x32\...\Odlotowa farma) (Version: - Alawar Entertainment Inc.) Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4719.1002 - Microsoft Corporation) Hidden Office 15 Click-to-Run Licensing Component (Version: 15.0.4719.1002 - Microsoft Corporation) Hidden Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4719.1002 - Microsoft Corporation) Hidden Ogniem i Mieczem - Dzikie Pola (HKLM-x32\...\{44F937C6-1433-4EE4-91DB-3F2030EAF55B}_is1) (Version: 1.143 - TaleWorlds Entertainment) Opera Stable 34.0.2036.25 (HKLM-x32\...\Opera 34.0.2036.25) (Version: 34.0.2036.25 - Opera Software) Origin (HKLM-x32\...\Origin) (Version: 9.5.12.2862 - Electronic Arts, Inc.) Pakiet sterowników systemu Windows - Lenovo (ACPIVPC) System (06/15/2012 8.1.0.1) (HKLM\...\71BC3FD63F450BA0A957AAECBDB4A000C4F2BE42) (Version: 06/15/2012 8.1.0.1 - Lenovo) Pakiet sterowników systemu Windows - Lenovo (WUDFRd) LenovoVhid (06/19/2012 10.13.29.733) (HKLM\...\8A223E56FB1ED4F697B54E5BF96F1EB63B512684) (Version: 06/19/2012 10.13.29.733 - Lenovo) Patrician IV (HKLM-x32\...\{25B473C3-2C62-482B-858F-94ED76880F79}) (Version: 1.3.0.0 - Kalypso Media) PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH) PDF Compressor (HKLM-x32\...\{74CB4E29-732C-47A6-B9C6-790EC768FCBA}) (Version: 2.7.0.0 - iWesoft) PDFBinder (HKLM-x32\...\{8BA03AC2-579F-41CD-A250-740137D86F7A}) (Version: 1.0.0 - Malamute.dk) PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.0 - pdfforge) Pharaoh & Cleopatra (HKLM-x32\...\{B2F800BF-D232-4CBB-AEFB-188CA32ABE89}) (Version: 2.1 - Sierra Entertainment) PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation) Plus Internet 2.5 (HKLM-x32\...\Plus Internet_is1) (Version: 2.5 - Polkomtel S.A.) Plus Internet Monitor wersja 1.0 (HKLM-x32\...\{64CFCC62-D81B-4A2B-81D6-169FBF95520A}_is1) (Version: 1.0 - Polkomtel sp. z o.o.) Podręcznik użytkownika (x32 Version: 1.0.0.9 - Lenovo) Hidden Podstawowe programy Windows Live (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation) Podstawowe programy Windows Live (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Polski pakiet językowy dla narzędzi Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - PLK) (Version: 10.0.50903 - Microsoft Corporation) Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.9109 - CyberLink Corp.) PreEmptive Analytics Visual Studio Components (x32 Version: 1.2.5134.1 - PreEmptive Solutions) Hidden Prerequisites for SSDT (HKLM-x32\...\{21373064-AD95-48DB-A32E-0D9E08EF7355}) (Version: 12.0.2000.8 - Microsoft Corporation) PrivDog (HKLM\...\{C01D249F-23DA-45B1-A5FF-12ECD647D5C6}) (Version: 3.0.108.0 - PrivDog.com) PrivDog 2 Legacy Browser Plug-ins (HKLM-x32\...\PrivDog) (Version: 2.2.0.14 - privdog.com) QPrinter (HKLM-x32\...\{a2d5c675-bdbe-4292-b0fe-d0aeff5bb055}_is1) (Version: - Pawel Lisowski) QPrinter 1.0.11 (HKLM-x32\...\{a2d5c675-bdbe-4292-b0fe-d0aeff5bb055}) (Version: - TriMedia) Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.206 - Nazwa firmy) Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros) QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.) Recuva (HKLM\...\Recuva) (Version: 1.52 - Piriform) Roslyn Language Services - x86 (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden Serious Sam HD: The Second Encounter (HKLM-x32\...\Steam App 41010) (Version: - Croteam) Settlers IV - Złota Edycja (HKLM-x32\...\{A2422674-F3A7-46F2-8966-EC6B1FBD6EB3}) (Version: 1.0 - ) SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 2.5.1.5 - Lenovo Group Limited) SimCity 4 (HKLM-x32\...\{3F0D0ABE-CDAF-431A-00BC-CBBE018EA74E}) (Version: 1.1.0.3 - Electronic Arts) Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.) Sniper Elite V2 (HKLM-x32\...\Steam App 63380) (Version: - Rebellion) SPORE™ (HKLM-x32\...\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}) (Version: 1.00.0000 - Electronic Arts) Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation) Stickies 7.1e (HKLM-x32\...\ZhornStickies) (Version: - Zhorn Software) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden System Requirements Lab Detection (HKLM-x32\...\{3AE8003F-3275-49C9-82C8-052A9D11BEA3}) (Version: 6.1.4.0 - Husdawg, LLC) Team Explorer for Microsoft Visual Studio 2015 (x32 Version: 14.0.23102 - Microsoft Corporation) Hidden Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve) Test Tools for Microsoft Visual Studio 2015 (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden TeXstudio 2.9.4 (HKLM-x32\...\TeXstudio_is1) (Version: 2.9.4 - Benito van der Zander) The Elder Scroll V - Skyrim version Patch 1.3 (HKLM-x32\...\{CA27E123-F2ED-44F6-A545-30DA2370D180}_is1) (Version: Patch 1.3 - Bethesda Studios) The Lord of the Rings Online™ (HKLM-x32\...\Steam App 212500) (Version: - Turbine, Inc.) Total War: SHOGUN 2 (HKLM-x32\...\Steam App 34330) (Version: - The Creative Assembly) Tropico 3 (HKLM-x32\...\{6CA1CD8C-2D65-491E-9467-00A3ACA4A0A9}) (Version: 1.00.0000 - Kalypso) TypeScript Power Tool (x32 Version: 1.6.3.0 - Microsoft Corporation) Hidden TypeScript Tools for Microsoft Visual Studio 2015 (x32 Version: 1.6.3.0 - Microsoft Corporation) Hidden TypeScript Tools for Microsoft Visual Studio 2015 1.6.3.0 (HKLM-x32\...\{da31aa25-410a-4c1b-9ec0-114dd8dff786}) (Version: 1.6.23313.0 - Microsoft Corporation) Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT) Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb) Update for (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation) UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.9 - Lenovo) Virtual Farm (HKLM-x32\...\Virtual Farm) (Version: - ) VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN) War Thunder (HKLM-x32\...\Steam App 236390) (Version: - Gaijin Entertainment) War Thunder Launcher 1.0.1.322 (HKLM-x32\...\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version: - 2013 Gaijin Entertainment Corporation) Warhammer® 40,000™: Dawn of War® II (HKLM-x32\...\Steam App 15620) (Version: - Relic Entertainment) WCF Data Services 5.6.4 Runtime (x32 Version: 5.6.62175.4 - Microsoft Corporation) Hidden WCF Data Services Tools for Microsoft Visual Studio 2015 (x32 Version: 5.6.62175.4 - Microsoft Corporation) Hidden Wiedźmin: Edycja rozszerzona wersja 1.6 (HKLM-x32\...\Wiedźmin: Edycja rozszerzona_is1) (Version: 1.6 - CD Projekt RED) Youda Farmer (HKLM-x32\...\{CA256FA1-4CF9-492C-98A6-6E451F83AEC3}) (Version: 1.0.0 - Youdagames) ZTE LTE Device USB Driver (HKLM\...\{00C1EF09-B5B7-4082-B1F4-C35CE7A7FCA9}) (Version: - ZTE Corporation) ==================== Niestandardowe rejestracje CLSID (filtrowane): ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Punkty Przywracania systemu ========================= 24-11-2015 12:14:00 Zaplanowany punkt kontrolny 01-12-2015 18:45:38 Zaplanowany punkt kontrolny 05-12-2015 11:55:29 Zainstalowany program DirectX ==================== Hosts - zawartość: =============================== (Użycie dyrektywy Hosts: w fixlist spowoduje reset pliku Hosts.) 2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Zaplanowane zadania (filtrowane) ============= (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) Task: {08AD60A5-775E-4714-888E-949464C23A18} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-05-18] (Microsoft Corporation) Task: {181106EE-28C3-4629-BE0F-DD750C22F6F1} - System32\Tasks\{AE91BA69-A1A4-4076-8DFB-FB08375530E6} => pcalua.exe -a H:\setup.exe -d H:\ Task: {1B529C5B-3863-4334-BD5F-396DCFA4B52A} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3680470863-837635135-2748872348-1002 => C:\Users\Patryk_2\AppData\Local\Microsoft\OneDrive\OneDrive.exe Task: {3176C64F-E4FB-4C7B-9021-7F4BC9A59C14} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2015-06-09] () Task: {38CEA989-E0E8-4DA3-8233-833E4CF5C9C9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {4513674C-45F5-495A-8759-A759F6DB7E6A} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3680470863-837635135-2748872348-1002UA => C:\Users\Patryk\AppData\Local\Dropbox\Update\DropboxUpdate.exe Task: {4F006DD8-7884-4EE6-B4A7-74CD687A5A5E} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-07] (COMODO) Task: {5C2419FA-5A6B-4CBE-A212-986F5ADBC80C} - System32\Tasks\Opera scheduled Autoupdate 1436204575 => C:\Program Files (x86)\Opera\launcher.exe [2015-12-10] (Opera Software) Task: {625A84C7-0AC1-4F0D-9E83-286E956A17A4} - System32\Tasks\{337D64FE-D5DA-40B1-934D-8E9D24CA6B1F} => pcalua.exe -a "C:\Program Files (x86)\Maxis\SimCity 4\eauninstall.exe" -d "C:\Program Files (x86)\Maxis\SimCity 4" Task: {6C4606BA-D0D4-4A04-8FC9-C980EABAFAA3} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-08-07] (COMODO) Task: {7EFB6DDE-1C09-41AD-A196-9A8C8AA7E4FD} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3680470863-837635135-2748872348-1002Core => C:\Users\Patryk\AppData\Local\Dropbox\Update\DropboxUpdate.exe Task: {90A444C6-5C9D-4201-A247-477428384F78} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2015-06-09] (Lenovo) Task: {99BEA713-DE5C-4866-B608-4D3555BDB848} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.) Task: {A5E969A1-6F00-40B6-A5ED-EC8FD5521CC6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-11-20] (Adobe Systems Incorporated) Task: {A81CDCE8-285B-42E3-81BF-D365034FF127} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2012-07-27] (CyberLink) Task: {A9D02E5A-48F5-4B85-B9E3-ACCBC0012DA4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.) Task: {AEA6EF43-3EB0-40A1-9D19-11ABBCDB05BE} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2015-06-09] () Task: {AFBA6309-BC08-4E7F-AADB-93D23EE0B8FF} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-05-07] (Piriform Ltd) Task: {B4AA9D80-4BC7-4E9E-9DF4-985709A97932} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-07-01] (Avast Software s.r.o.) Task: {BD472BAD-CA46-405D-B46A-861B7839A231} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-3680470863-837635135-2748872348-1002 Task: {D1EBEA14-C11C-4550-A18B-B25ACAE0C8A9} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2015-09-24] (Lenovo) Task: {DC56CCA1-3F4C-4107-99A5-E0CC3800391E} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-07] (COMODO) Task: {E18B9475-EC64-46FE-8168-B366DD7D43DC} - System32\Tasks\Lenovo\LSC\LSCTaskService => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCTaskService.exe [2015-06-09] (Lenovo) Task: {E67A6B56-3403-4AD7-BCA1-0E24FDA30FC4} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2015-06-09] (Lenovo) Task: {E85A04AD-A1A9-4B77-9919-C784B04D701A} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-12-09] (Adobe Systems Incorporated) Task: {E9C987B0-2A7C-4B40-B3A1-024828B8298E} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-08-07] (COMODO) Task: {F8DC7B9A-8B64-4BC6-8549-513003E48C8A} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe Task: {FA5E6A22-7106-48D4-BC77-93C4A1B3778D} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2015-12-03] (AVAST Software) (Załączenie wejścia w fixlist spowoduje przesunięcie pliku zadania (.job). Plik uruchamiany docelowo przez zadanie nie zostanie przeniesiony.) Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-3680470863-837635135-2748872348-1002Core.job => C:\Users\Patryk\AppData\Local\Dropbox\Update\DropboxUpdate.exe Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-3680470863-837635135-2748872348-1002UA.job => C:\Users\Patryk\AppData\Local\Dropbox\Update\DropboxUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Skróty ============================= (Wybrane wejścia mogą zostać załączone w celu ich zresetowania lub usunięcia.) ShortcutWithArgument: C:\Users\Patryk_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449734008&z=9e06f432922dad23fa641a2gczczdtbm7caz3e1eft&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2U5J9DC835630 <==== UWAGA ShortcutWithArgument: C:\Users\Patryk_2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449734008&z=9e06f432922dad23fa641a2gczczdtbm7caz3e1eft&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2U5J9DC835630 <==== UWAGA ShortcutWithArgument: C:\Users\Patryk_2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449734008&z=9e06f432922dad23fa641a2gczczdtbm7caz3e1eft&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2U5J9DC835630 <==== UWAGA ShortcutWithArgument: C:\Users\Patryk_2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera.lnk -> C:\Program Files (x86)\Opera\launcher.exe (Opera Software) -> hxxp://www.yoursites123.com/?type=sc&ts=1449734008&z=9e06f432922dad23fa641a2gczczdtbm7caz3e1eft&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2U5J9DC835630 <==== UWAGA ShortcutWithArgument: C:\Users\Patryk_2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\5d696d521de238c3\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449734008&z=9e06f432922dad23fa641a2gczczdtbm7caz3e1eft&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2U5J9DC835630 <==== UWAGA ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449734008&z=9e06f432922dad23fa641a2gczczdtbm7caz3e1eft&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2U5J9DC835630 <==== UWAGA ==================== Załadowane moduły (filtrowane) ============== 2006-12-04 00:26 - 2006-12-04 00:26 - 00022016 _____ () C:\WINDOWS\System32\sugo3l6.dll 2014-03-07 22:23 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll 2015-07-06 13:41 - 2015-07-06 13:41 - 00240720 _____ () C:\ProgramData\MobileBrServ\mbbservice.exe 2011-03-14 16:27 - 2011-03-14 16:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe 2013-06-13 07:27 - 2012-09-22 03:32 - 00655744 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe 2010-07-15 05:44 - 2010-07-15 05:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll 2014-05-12 10:49 - 2014-05-12 10:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll 2012-08-10 17:28 - 2012-08-10 17:28 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll 2015-03-07 01:07 - 2015-03-07 01:07 - 00908568 _____ () C:\Program Files\Logitech Gaming Software\libGLESv2.dll 2015-07-02 01:28 - 2015-07-02 01:28 - 01095448 _____ () C:\Program Files\Logitech Gaming Software\platforms\qwindows.dll 2015-03-07 01:07 - 2015-03-07 01:07 - 00060184 _____ () C:\Program Files\Logitech Gaming Software\libEGL.dll 2015-07-02 01:28 - 2015-07-02 01:28 - 00240408 _____ () C:\Program Files\Logitech Gaming Software\imageformats\qjpeg.dll 2013-10-03 23:42 - 2013-10-03 23:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2015-04-08 20:53 - 2015-04-08 20:53 - 00050688 _____ () C:\Program Files\CCleaner\lang\lang-1045.dll ==================== Alternate Data Streams (filtrowane) ========= (Załączenie wejścia w fixlist spowoduje usunięcie strumienia ADS.) AlternateDataStreams: C:\WINDOWS\avastSS.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\HelpPane.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\hh.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\notepad.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\regedit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\splwow64.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\twain_32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\winhlp32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\write.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\accessibilitycpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\acledit.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\aclui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\acmigration.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\acppage.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\acproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ActionCenter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ActionCenterCPL.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ActionQueue.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\activeds.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\actxprxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\adhapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\adhsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\adprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\adsldp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\adsldpc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\adsmsext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\adsnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\adtschema.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\advapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\advpack.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\aecache.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\aeinv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\aelupsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\aepdu.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\aepic.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AepRoam.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\aitagent.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\aitstatic.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\alg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AltTab.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\amstream.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\apds.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Apphlpdm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\appidapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\appidcertstorecheck.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\appidpolicyconverter.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\appidsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\appinfo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\appraiser.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AppReadiness.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\apprepapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\apprepsync.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\appsruprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\appwiz.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AppxAllUserStore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AppxApplicabilityEngine.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentClient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentExtensions.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentServer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AppxPackaging.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AppxSip.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AppxStreamingDataSourcePS.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AppxSysprep.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ARP.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\aspnet_counters.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\asycfilt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\at.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AtBroker.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\atl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\atlthunk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\atmfd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\atmlib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\attrib.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\audiodg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AudioEndpointBuilder.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AudioEng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AUDIOKSE.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AudioSes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\audiosrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\auditcse.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\auditpol.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AuthBroker.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AuthExt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\authfwcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AuthFWGP.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AuthFWSnapin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AuthFWWizFwk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AuthHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AuthHostProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\autoconv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\autoplay.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AutoWorkplaceN.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\avicap32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\avifil32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\avrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AxInstSv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AxInstUI.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\azroles.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\azroleui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\AzSqlExt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\backgroundTaskHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BackgroundTransferHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\basecsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\basesrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\batmeter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bcd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bcdboot.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bcdedit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bcdprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bcdsrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BCP47Langs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bcrypt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bcryptprimitives.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bdaplgin.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BdeHdCfgLib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bderepair.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bdesvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bdeui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BdeUISrv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bdeunlock.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BFE.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bidispl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BioCredProv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bisrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BitLockerDeviceEncryption.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BitLockerWizardElev.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bitsadmin.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bitsigd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bitsperf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bitsprx2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bitsprx3.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bitsprx4.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bitsprx5.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bitsprx6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bitsprx7.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\biwinrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\blackbox.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\blb_ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BluetoothApis.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bootcfg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bootim.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BootMenuUX.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bootsect.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bootux.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\brdgcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bridgeunattend.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BrokerLib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\browcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\browser.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\browseui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bthci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BthHFSrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BthMtpContextHandler.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bthpanapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BthpanContextHandler.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bthprops.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BthRadioMedia.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bthserv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BthSQM.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\bthudtask.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\btpanui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Bubbles.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BulkOperationHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\BWContextHandler.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ByteCodeGenerator.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cabinet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cabview.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cacls.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CallButtons.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CallButtons.ProxyStub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CameraSettingsUIHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\capiprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\capisp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\catsrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\catsrvps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\catsrvut.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cca.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cdd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cdosys.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\certca.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\certcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\certCredProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\certenc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CertEnroll.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CertEnrollCtrl.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CertEnrollUI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\certmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CertPolEng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\certprop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\certreq.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\certutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cewmdm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cfgbkend.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cfgmgr32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cfmifs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cfmifsproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\charmap.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\chartv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\chcp.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CheckNetIsolation.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\chkdsk.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\chkntfs.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\chkwudrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\choice.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CHxReadingStringIME.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cic.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cipher.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CIRCoInst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\clb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\clbcatq.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cleanmgr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\clfsw32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cliconfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cliconfg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\clip.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CloudNotifications.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CloudStorageWizard.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\clusapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmcfg32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmd.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmdext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmdial32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmdkey.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmdl32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmifw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmlua.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmmon32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmpbk32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmstp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmstplua.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cmutil.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cngcredui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cngprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cnvfat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cofire.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cofiredm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\colbact.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\COLORCNV.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\colorcpl.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\colorui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\combase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\comcat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\comdlg32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\comp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\compact.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CompMgmtLauncher.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CompPkgSup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\compstui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ComputerDefaults.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\comrepl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\comsnap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\comsvcs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\comuid.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ConfigureExpandedStorage.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\conhost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\connect.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ConnectedAccountState.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\consent.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ConsentUX.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\console.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\control.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\convert.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\correngine.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CPFilters.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CredentialMigrationHandler.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CredentialUIBroker.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\credssp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\credui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\credwiz.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cryptbase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cryptcatsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cryptdlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cryptdll.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cryptext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cryptnet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CryptoWinRT.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cryptsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cryptsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\crypttpmeksvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cryptui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cryptuiwizard.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cryptxml.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cscapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cscdll.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cscript.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\CSystemEventsBrokerClient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ctfmon.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cttune.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\cttunesvr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\C_G18030.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\C_IS2022.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\C_ISCII.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\d2d1.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\d3d10.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\d3d10core.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\d3d10level9.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\d3d10warp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\d3d10_1.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\d3d10_1core.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\d3d11.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\d3d8thk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\d3d9.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_47.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dab.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dabapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DAConn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dafBth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DafPrintProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dafupnp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dafWCN.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dafWfdProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DAFWSD.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DAMM.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DaOtpCredentialProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\das.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dasHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dataclen.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\datusage.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\davclnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\davhlpr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dbnetlib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dbnmpntw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dccw.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dciman32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dcomcnfg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dcomp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DDACLSys.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ddodiag.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DDOIProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DDORes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ddraw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ddrawex.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DefaultDeviceManager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DefaultPrinterProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Defrag.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\defragproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\defragsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\delegatorprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\desk.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\deskadp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\deskmon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DevDispItemProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\devenum.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\deviceaccess.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\deviceassociation.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DeviceCenter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DeviceDisplayStatusManager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DeviceDriverRetrievalClient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DeviceEject.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DeviceElementSource.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DeviceMetadataRetrievalClient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DevicePairing.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DevicePairingFolder.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DevicePairingProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DevicePairingWizard.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DeviceProperties.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\deviceregistration.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DeviceSetupManager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DeviceSetupManagerAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DeviceUxRes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\devinv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\devmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\devobj.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DevPropMgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\devrtl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dfdts.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DFDWiz.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dfp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DfpCommon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dfrgui.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dfscli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DfsShlEx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dhcpcmonitor.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dhcpcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dhcpcore6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dhcpcsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dhcpcsvc6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DHCPQEC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dhcpsapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DiagCpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\diagperf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dialer.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\difxapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dimsjob.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dimsroam.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dinput.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dinput8.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\discan.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\diskcomp.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\diskcopy.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\diskcopy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\diskpart.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\diskperf.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\diskraid.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dispci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dispdiag.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dispex.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Display.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DisplaySwitch.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\djoin.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dllhost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dllhst3g.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dlnashext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dmdlgs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dmdskmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dmintf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dmloader.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dmocx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DMRServer.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dmsynth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dmusic.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dmutil.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dmvdsitf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dmview.ocx:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dnsapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dnscacheugc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dnsext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dnshc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dnsrslvr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\docprop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\doskey.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dot3api.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dot3cfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Dot3Conn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dot3dlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dot3gpclnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dot3gpui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dot3hc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dot3mm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dot3msm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dot3svc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dot3ui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dpapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dpapimig.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dpapiprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DpiScaling.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\driverquery.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\drmmgrtn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\drmv2clt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\drprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\drt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\drtprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\drttransport.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\drvcfg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\drvinst.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\drvstore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dsauth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DscCore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DscCoreConfProv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dsdmo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dskquota.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dskquoui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DsmUserTask.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dsound.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dsparse.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dsprop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dsquery.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dsrole.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dssec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dssenh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Dsui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dsuiext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dswave.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dtsh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dui70.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\duser.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dvdplay.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dvdupgrd.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dwm.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dwmapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dwmredir.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DWrite.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DWWIN.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dxcap.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dxcpl.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dxdiag.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dxdiagn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dxgi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dxgwdi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dxmasf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DXP.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dxpps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Dxpserver.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\DxpTaskSync.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dxtmsft.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dxtrans.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\dxva2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Eap3Host.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\eappgnui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\eapphost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\eappprxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\eapprovp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\EAPQEC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\eapsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\easconsent.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\EaseOfAccessDialog.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\easinvoker.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\easinvoker.proxystub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\easwrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\efsadu.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\efscore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\efslsaext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\efssvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\efsui.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\efsutil.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\efswrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\EhStorAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\EhStorAuthn.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\EhStorPwdMgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\EhStorShell.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\els.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ELSCore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\elshyph.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\elslad.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\elsTrans.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\encapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\EncDec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\EncDump.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\energy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\energyprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\energytask.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\eqossnap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\es.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\esent.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\esentprf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\esentutl.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\eudcedit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\EventAggregation.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\eventcls.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\eventcreate.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\eventvwr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\evr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\expand.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ExplorerFrame.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\extrac32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Faultrep.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fdBth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fdBthProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FdDevQuery.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fde.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fdeploy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fdPHost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fdPnp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fdprint.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fdProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FDResPub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fdSSDP.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fdWCN.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fdWNet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fdWSD.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\feclient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhautoplay.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhcat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhcleanup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhcpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhengine.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhevents.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhlisten.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhmanagew.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhshl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhsrchapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhsrchph.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhsvcctl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fhtask.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FileAppxStreamingDataSource.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\filemgmt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\find.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\findnetprinters.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\findstr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\finger.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Firewall.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FirewallAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FirewallControlPanel.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fixmapi.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fltLib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fltMC.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fmapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fmifs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fms.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FntCache.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Fondue.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fontext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fontsub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fontview.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\forfiles.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\format.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fphc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\framedyn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\framedynos.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\frprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fsavailux.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fsquirt.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fsutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fsutilext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fthsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ftp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fundisc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fveapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fveapibase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fvecerts.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fvecpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fvenotify.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fveskybackup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fveui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fvewiz.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\fwcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FWPUCLNT.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FwRemoteSvr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSCOM.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSCOMEX.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSCOMPOSE.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSCOVER.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSMON.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSROUTE.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSST.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSSVC.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXST30.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSTIFF.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSUNATD.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\FXSUTILITY.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\g711codc.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\gacinstall.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\gameux.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\gcdef.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\gdi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\GdiPlus.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\generaltel.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\GeofenceMonitorService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\getmac.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\getuname.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\glcndFilter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\glmf32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\GlobCollationHost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\globinputhost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\glu32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\gpapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\gpedit.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\gpprnext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\gpresult.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\gpsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\gptext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\gpupdate.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Groupinghc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\grpconv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hbaapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hcproviders.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hdwwiz.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hdwwiz.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\help.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\HelpPaneProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hgcpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hgprint.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hhctrl.ocx:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hhsetup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hid.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hidphone.tsp:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hidserv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hnetcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hnetmon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\HOSTNAME.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hotplug.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hotspotauth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\httpapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\httpprxm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\httpprxp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\htui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hwrcomp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\hwrreg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ias.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iasacct.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iasads.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iasdatastore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iashlpr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\IasMigPlugin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iasnap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iaspolcy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iasrad.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iasrecst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iassam.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iassdo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iassvcs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\icacls.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\icfupgd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\icm32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\icmui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\IconCodecService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\icsigd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\icsunattend.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\icsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\IdCtrls.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\IdListen.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\idndl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\IDStore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ie4uinit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ieapfltr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ieframe.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iepeers.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iertutil.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ieui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ifmon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ifsutil.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ifsutilx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\igdDiag.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\IKEEXT.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\imaadp32.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\imagehlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\imapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\imapi2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\imapi2fs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\imm32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\immersivetpmvscmgrsvr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\inetcpl.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\inetmib1.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\inetpp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\inetppui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\InfDefaultInstall.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\InkEd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\input.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\InputSwitch.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\inseng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\intl.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\invagent.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ipconfig.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\IPHLPAPI.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iphlpsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ipnathlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iprtprio.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iprtrmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ipsecsnp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\IPSECSVC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ipsmsnap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\irclass.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\irftp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\irmon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\irprops.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iscsicli.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iscsicpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iscsicpl.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iscsidsc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iscsied.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iscsiexe.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iscsium.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iscsiwmi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iscsiwmiv2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\isoburn.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\itircl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\itss.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iuilp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\iyuv_32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\java.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\javaw.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\javaws.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\jnwmon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\joy.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\jscript9diag.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\KdsCli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\kdusb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\kd_02_8086.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\keepaliveprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\kernel.appcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\kernel32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\KernelBase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\kernelceip.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\keyiso.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\keymgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\klist.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\kmddsp.tsp:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\KMSVC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\korwbrkr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ksetup.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ksproxy.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\kstvtune.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ksuser.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Kswdmcap.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ksxbar.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ktmutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ktmw32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\l2gpstore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\l2nacp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\L2SecHC.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\l3codeca.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\l3codecp.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\label.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\LangCleanupSysprepAction.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\LAPRXY.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\LaunchTM.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\linkinfo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ListSvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\livessp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\LldpNotify.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lltdapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lltdsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lmhsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\loadperf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\localsec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\localspl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\localui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\LocationApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\LocationNotifications.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Locator.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\LockScreenContent.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\LockScreenContentHost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lodctr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\logagent.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\loghours.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\logman.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\logoncli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\LogonUI.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lpk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lpkinstall.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lpksetup.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lpksetupproxyserv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lpremove.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lsasrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lsass.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\lsmproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\luainstall.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Magnification.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Magnify.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\main.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MaintenanceUI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\makecab.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\manage-bde.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mapistub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MbaeApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MbaeApiPublic.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MbaeParserTask.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MbaeXmlParser.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mblctr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mbsmsapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mbussdapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mcbuilder.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mciavi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mcicda.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mciqtz32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mciseq.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mciwave.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mcupdate_GenuineIntel.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\McxDriv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MDEServer.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MDMAgent.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mdminst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mdmregistration.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MdRes.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MdSched.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MemoryDiagnostic.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mf3216.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfAACEnc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfasfsrcsnk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfc42.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfc42u.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MFCaptureEngine.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfcsubs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfds.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfdvdec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfh264enc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MFMediaEngine.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfmjpegdec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfmp4srcsnk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfmpeg2srcsnk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfnetcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfnetsrc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfplat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MFPlay.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfpmp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfreadwrite.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfsrcsnk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfsvr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mftranscode.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mfvdsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MFWMAAEC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mgmtapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mibincodec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\microsoft-windows-system-events.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Microsoft.Management.Infrastructure.Native.Unmanaged.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MicrosoftAccountTokenProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\midimap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\migflt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\miguiresource.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mimefilt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mimofcodec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MirrorDrvCompat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mispace.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\miutils.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mlang.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mmc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mmcbase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mmci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mmcico.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mmcndmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mmcshext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mmcss.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MMDevAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mmsys.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mobsync.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mode.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\modemui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\montr_ci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\more.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mountvol.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MP3DMOD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MP43DECD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MP4SDECD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Mpeg2Data.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mpg2splt.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MPG4DECD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mpnotify.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mpr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mprapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mprddm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mprdim.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mprext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mprmsg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MPSSVC.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MRINFO.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MrmIndexer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msaatext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSAC3ENC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msacm32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msacm32.drv:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msadp32.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msasn1.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSAudDecMFT.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msaudite.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msauserext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mscandui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mscat32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msched.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSchedExe.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mscms.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msconfig.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msctf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msctfime.ime:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MsCtfMonitor.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msctfp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msctfui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msctfuimanager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdadiag.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdart.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdelta.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdmo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdri.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdrm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdt.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdtc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdtckrm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdtclog.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdtcprx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdtctm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdtcuiu.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSDvbNP.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msdxm.ocx:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msfeeds.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msg711.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msgsm32.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mshtml.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MshtmlDac.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mshtmled.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MsiCofire.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msidcrl40.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msident.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msidle.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msieftp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msiexec.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msihnd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msiltcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msimg32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msimtf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msinfo32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msisip.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msiwer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mskeyprotcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mskeyprotect.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msls31.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSMPEG2ENC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msmpeg2vdec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msnetobj.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSNP.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msoeacct.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msoert2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mspaint.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mspatcha.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mspatchc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msports.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msra.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msrahc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msrdc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MsRdpWebAccess.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msrle32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msscp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mssha.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mssign32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mssip32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MsSpellCheckingFacility.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MsSpellCheckingHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mstask.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msTextPrediction.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mstsc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msutb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msv1_0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msvcirt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msvcp60.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msvcrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msvfw32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msvidc32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSVidCtl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSVideoDSP.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msvproc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSWB7.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSWB70011.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSWB7001E.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSWB70404.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MSWB70804.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mswmdm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mswsock.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msxml3.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msxml6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\msyuv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mtstocom.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mtxclu.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mtxdm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mtxex.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mtxoci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\muifontsetup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MUILanguageCleanup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MuiUnattend.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\MultiDigiMon.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mycomput.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\mydocs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Mystify.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\napdsnap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NapiNSP.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\napipsec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NAPMONTR.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NAPSTAT.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Narrator.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NaturalLanguage6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nbtstat.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NcaApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NcaSvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ncbservice.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NcdAutoSetup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NcdProp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ncobjapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ncpa.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ncrypt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ncryptprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ncryptsslp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ncuprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ndadmin.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nddeapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ndfapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ndfetw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ndfhcdiscovery.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ndiscapCfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ndishc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NdisImPlatform.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ndproxystub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nduprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\negoexts.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\net.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\net1.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netbios.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netbtugc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netcenter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netcfg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netcfgx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netcorehc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netdiagfx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NetEvtFwdr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netid.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netiohlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netiougc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netjoin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netlogon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netman.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netplwiz.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Netplwiz.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netprofm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netprofmsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netprovisionsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NetSetupApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netsh.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netshell.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NETSTAT.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nettrace.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\netutils.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NetVscCoinstall.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\networkexplorer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\networkitemfactory.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NetworkStatus.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\newdev.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\newdev.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ninput.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NL7Data0011.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NL7Data001E.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NL7Data0404.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NL7Data0804.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nlahc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nlhtml.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nlmgp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nlmproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nlmsprep.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0000.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0002.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0003.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0007.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0009.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData000a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData000c.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData000d.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData000f.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0010.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0018.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData001a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData001b.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData001d.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0020.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0021.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0022.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0024.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0026.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0027.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData002a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0039.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData003e.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0045.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0046.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0047.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0049.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData004a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData004b.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData004c.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData004e.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0414.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0416.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0816.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData081a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsData0c1a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Nlsdl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\NlsLexicons0009.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nltest.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\normaliz.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\notepad.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\npmproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nrpsrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nshhttp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nshipsec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nshwfp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nsi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nsisvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\nslookup.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ntasn1.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ntdll.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ntdsapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ntlanman.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ntlanui2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ntmarta.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ntprint.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ntprint.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ntshrui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ntvdm64.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\objsel.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ocsetapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\odbc32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\odbcad32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\odbcbcp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\odbcconf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\odbcconf.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\odbccp32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\odbccr32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\odbccu32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\odbctrac.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OEMLicense.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\offfilt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\offreg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ogldrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ole32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\oleacc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\oleacchooks.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\oleaut32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\oledlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\oleprn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OnDemandConnRouteHelper.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\onex.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\onexui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OobeFldr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OPC02LOC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OPCLB025.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OpcServices.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OPDMN025.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OPDVA025.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OPE02LOC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\openfiles.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\opengl32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OpenWith.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OPEXTUAC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OPSLD025.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OptionalFeatures.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OPUSB025.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OPUSBEXT.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\osbaseln.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\osk.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\OskSupport.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\osuninst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\P2P.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\P2PGraph.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\p2pnetsh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\p2psvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\packager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PackageStateRoaming.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\panmap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PasswordOnWakeSettingFlyout.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PATHPING.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pautoenr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pcacli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pcadm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pcalua.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pcasvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pcaui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pcaui.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PCPKsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PCPTpm12.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pcsvDevice.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pcwrun.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pcwutl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pdh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pdhui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\perfctrs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\perfdisk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\perfmon.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\perfnet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\perfos.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\perfproc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\perftrack.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\perfts.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PhotoScreensaver.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\photowiz.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PickerHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pid.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PING.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PkgMgr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pla.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\plasrv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\playlistfolder.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PlaySndSrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PlayToDevice.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PlayToManager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PlayToStatusProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ploptin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pnidui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pnpclean.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pnppolicy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pnpts.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pnpui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PnPUnattend.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PnPutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PNPXAssoc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PNPXAssocPrx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pnrpauto.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Pnrphc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pnrpnsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pnrpsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\polstore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\poqexec.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceClassExtension.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceConnectApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceStatus.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceSyncProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceTypes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceWiaCompat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceWMDRM.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pots.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\powercfg.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\powercfg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\powercpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\powrprof.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\prevhost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\print.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PrintDialogHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PrintDialogs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\printfilterpipelineprxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\printfilterpipelinesvc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PrintIsolationHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PrintIsolationProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\printui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\printui.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\prncache.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\prnfldr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\prnntfy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\prntvpt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\procinst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\profapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\profext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\profprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\profsvcext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\propsys.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\proquota.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\provcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\provsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\provthrd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ProximityCommon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ProximityCommonPal.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ProximityRtapiPal.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ProximityService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ProximityServicePal.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ProximityUxHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\prvdmofcomp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\psapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\psisdecd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\psisrndr.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PSModuleDiscoveryProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\psmsrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\psr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pstask.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pstorec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\puiapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\puiobj.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PurchaseWindowsLicense.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\PurchaseWindowsLicense.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pwlauncher.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pwlauncher.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pwrshplugin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\pwsso.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\QAGENT.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\QAGENTRT.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\qasf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\QCLIPROV.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\qdv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\qdvd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\qedit.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\qmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\qmgrprxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\QSHVHOST.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\QSVRMGMT.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\quartz.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Query.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\QUTIL.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\qwave.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RacEngn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\racpldlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\radardt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\radarrs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RADCUI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasadhlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasauto.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasautou.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rascfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\raschap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\raschapext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasctrs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rascustom.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasdiag.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasdial.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasdlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\raserver.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasgcw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasman.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasmans.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasmbmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RASMM.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasmontr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasmxs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasphone.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasplap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasppp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rasser.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rastapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rastls.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rastlsext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rdbui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rdpcfgex.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rdpclip.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rdpcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rdpencom.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rdpendp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rdpinput.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RdpSa.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RdpSaProxy.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RdpSaPs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RdpSaUacHelper.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rdrleakdiag.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RDSAppXHelper.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rdsdwmdr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RDSPnf.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rdvidcrl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rdvvmtransport.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ReAgent.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ReAgentc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ReAgentTask.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\recimg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\recover.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\recovery.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RecoveryDrive.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\reg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\regapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RegCtrl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\regedt32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\regidle.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\regini.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Register-CimProvider.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\regsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\regsvr32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ReInfo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rekeywiz.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\relog.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RelPost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\remotepg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\remotesp.tsp:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RemoveDeviceContextHandler.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RemoveDeviceElevated.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\repair-bde.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\replace.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RESAMPLEDMO.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\reseteng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\resmon.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RestoreOptIn.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\resutils.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rgb9rast.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Ribbons.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\riched20.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\riched32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RMActivate.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RMActivate_isv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RMActivate_ssp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RMActivate_ssp_isv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RMapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RmClient.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rmttpmvscmgrsvr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rnr20.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RoamingSecurity.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Robocopy.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RotMgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ROUTE.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RpcEpMap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rpchttp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RpcNs4.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rpcnsh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RpcPing.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rpcrt4.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RpcRtRemote.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rpcss.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rrinstaller.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rsaenh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rshx32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RstrtMgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rstrui.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rtffilt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rtm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rtutils.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RTWorkQ.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\runas.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\rundll32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RunLegacyCPLElevated.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\runonce.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\RuntimeBroker.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\samcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\samlib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\samsrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sas.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sbe.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sbeio.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\scansetting.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SCardDlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SCardSvr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\scavengeui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sccls.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ScDeviceEnum.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\scecli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\scesrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\scext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\schedcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\schedsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\schtasks.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\scksp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\scripto.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\scrnsave.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\scrobj.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\scrrun.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sdchange.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sdclt.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sdhcinst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sdiageng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sdiagnhost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sdiagprv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sdiagschd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sdohlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SearchFolder.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SecEdit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sechost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\secinit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\seclogon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\secproc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\secproc_isv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\secproc_ssp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\secproc_ssp_isv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\secur32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sendmail.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Sens.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SensApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SensorsApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SensorsClassExtension.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SensorsCpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sensrsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\serialui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\serwvdrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SessEnv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sessionmsg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\setbcdlocale.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sethc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SetNetworkLocation.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SetProxyCredential.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\setspn.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SettingMonitor.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SettingSync.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SettingSyncCore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SettingSyncHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SettingSyncPolicy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\setupapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\setupcln.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\setupugc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\setx.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sfc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sfc_os.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shacct.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sharemediacpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SHCore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shdocvw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shfolder.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shgina.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shimgvw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shlwapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shpafact.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shrpubw.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shsetup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shsvcs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shunimpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shutdown.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\shwebsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\signdrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sigverif.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SimAuth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SimCfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sisbkup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SkyDrive.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SkyDriveShell.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SkyDriveTelemetry.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SlideToShutDown.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\slpts.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SmartcardCredentialProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SmartCardSimulator.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SmartScreenSettings.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SMBHelperClass.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\smbwmiv2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\smphost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SmsDeviceAccessRevocation.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SMSRouter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SndVol.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SndVolSSO.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SnippingTool.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\snmpapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\snmptrap.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SNTSearch.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\softkbd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\softpub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sort.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SortServer2003Compat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SortWindows61.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SortWindows6Compat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SoundRecorder.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SpaceAgent.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SpaceControl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\spbcd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\spfileq.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SPInf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\spmpm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\spnet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\spoolss.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\spoolsv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\spopk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\spp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sppnp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sppobjs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\spwinsat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\spwizeng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\spwmp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sqlcecompact40.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sqlceoledb40.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sqlceqp40.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sqlcese40.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sqlsrv32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sqmapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\srchadmin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\srclient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\srcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\srhelper.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\srrstr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SrTasks.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\srumapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\srumsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\srvcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\srvsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\srwmi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sscore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sscoreext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ssdpapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ssdpsrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sspicli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sspisrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SSShim.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ssText3d.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sstpsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Startupscan.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\stclient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sti.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\StikyNot.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sti_ci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\stobject.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\storagewmi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\storagewmi_passthru.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\storewuauth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Storprop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\StorSvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\streamci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\StructuredQuery.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SubscriptionMgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\subst.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sud.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\svchost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\svsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\swprv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sxproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sxs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sxshared.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sxssrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sxsstore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sxstrace.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SyncCenter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\synceng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SyncHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SyncHostps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SyncInfrastructure.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SyncInfrastructureps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Syncreg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\syncui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sysclass.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sysdm.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SysFxUI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\syskey.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sysmain.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sysmon.ocx:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\sysntfy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SysResetErr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\syssetup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\systemcpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemEventsBrokerClient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemEventsBrokerServer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\systeminfo.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesAdvanced.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesComputerName.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesDataExecutionPrevention.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesHardware.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesPerformance.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesProtection.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesRemote.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\systemreset.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemSettings.DeviceEncryptionHandlers.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemSettings.Handlers.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsAdminFlows.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsDatabase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsRemoveDevice.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\systray.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\t2embed.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Tabbtn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TabbtnEx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tabcal.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TabletPC.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TabSvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\takeown.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tapi3.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tapilua.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TapiMigPlugin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tapiperf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tapisrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TapiSysprep.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TapiUnattend.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\taskbarcpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\taskcomp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\taskeng.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\taskhost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\taskhostex.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\taskkill.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tasklist.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Taskmgr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\taskschd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TaskSchdPS.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tbs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tcmsetup.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tcpipcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TcpipSetup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tcpmib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tcpmon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tcpmonui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TCPSVCS.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\telephon.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\termmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\termsrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TetheringIeProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TetheringMgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TetheringStation.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\themecpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\themeservice.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\themeui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\threadpoolwinrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\thumbcache.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ThumbnailExtractionHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TimeBrokerClient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TimeBrokerServer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\timedate.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TimeDateMUICallback.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\timeout.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TimeSyncTask.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tlscsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tpmcompc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TpmInit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TpmTasks.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tpmvsc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tpmvscmgr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tpmvscmgrsvr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tracerpt.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TRACERT.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\traffic.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tree.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\trkwks.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tsbyuv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TSChannel.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tsgqec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tsmf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TSpkg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TSTheme.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TsUsbGDCoInstaller.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TsUsbRedirectionGroupPolicyExtension.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TSWorkspace.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TtlsAuth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TtlsCfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\TtlsExt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tvratings.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\twext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\twinapi.appcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\twinapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\twinui.appcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\txflog.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\txfw32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\typeperf.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\tzutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ucmhc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ucrtbase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\udhisapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\uDWM.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\uexfat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ufat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\UI0Detect.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\UIAnimation.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\uicom.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\uireng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\UIRibbonRes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ulib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\umb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\umdmxfrm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\umpnpmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\umpo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\umpoext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\umpowmi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\umrdp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\unattend.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\unimdm.tsp:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\unimdmat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\uniplat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\unlodctr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\unrar64.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\unregmp2.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\untfs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\upnp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\upnpcont.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\upnphost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ureg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\usbceip.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\usbmon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\usbperf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\usbui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\user32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\UserAccountBroker.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\UserAccountControlSettings.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\UserAccountControlSettings.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\usercpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\userenv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\userinit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\userinitext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\UserLanguageProfileCallback.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\UserLanguagesCpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\usp10.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ustprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\utildll.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Utilman.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\uudf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\UXInit.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\uxlib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\uxtheme.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\VAN.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Vault.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vaultcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\VaultCmd.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\VaultRoaming.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vaultsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\VBICodec.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vbisurf.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vbscript.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vds.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vdsbas.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vdsdyn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vdsldr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vdsutil.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vdsvd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vds_ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\verclsid.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\verifier.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\verifier.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\version.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vfwwdm32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vidcap.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\VIDRESZR.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\virtdisk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\VmApplicationHealthMonitorProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vmbuspipe.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\VmdCoinstall.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vmictimeprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vmrdvcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vpnike.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vpnikeapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\VscMgrPS.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vsgraphicsremoteengine.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vsjitdebugger.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vssadmin.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vssapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vsstrace.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\VSSVC.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\vss_ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\w32time.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\w32tm.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\w32topl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WABSyncProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\waitfor.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WallpaperHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WavDest.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wavemsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wbadmin.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wbemcomn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wbengine.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wbiosrvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wcmapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wcmcsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wcmsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WcnApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wcncsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WcnEapAuthProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WcnEapPeerProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WcnNetsh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wcnwiz.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WcsPlugInService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wdc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wdi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wdiasqmmodule.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wdigest.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wdmaud.drv:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wdscore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WebcamUi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\webcheck.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WebClnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\webio.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\webservices.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Websocket.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wecapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wecsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wecutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wephostsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\werconcpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wercplsupport.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WerFault.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WerFaultSecure.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wermgr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wersvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\werui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wevtapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wevtfwd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wevtutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wfapigp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wfdprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WfHC.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WFS.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\where.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\whhelper.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\whoami.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wiaacmgr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wiaaut.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wiadefui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wiadss.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wiafbdrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wiarpc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wiascanprofiles.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wiaservc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wiashext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wiatrace.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WiFiDisplay.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wimgapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wimserv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winbici.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winbio.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winbrand.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wincorlib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wincredprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Background.SystemEventsBroker.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Background.TimeBroker.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Data.Pdf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Background.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Background.ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Custom.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Custom.ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Enumeration.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Enumeration.ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Geolocation.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.PointOfService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Portable.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Printers.Extensions.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Scanners.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Sensors.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.SmartCards.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Usb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.WiFiDirect.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Globalization.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Globalization.Fontgroups.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Graphics.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Graphics.Printing.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\windows.immersiveshell.serviceprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Management.Workplace.WorkplaceSettings.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Devices.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.MediaControl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Renewal.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.SpeechSynthesis.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Streaming.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Streaming.ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.ContentPrefetchTask.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.Connectivity.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.HostName.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.NetworkOperators.HotspotAuthentication.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.Proximity.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.Sockets.PushEnabledApplication.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.Vpn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Credentials.UI.CredentialPicker.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Credentials.UI.UserConsentVerifier.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Storage.Compression.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.System.Display.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.System.Profile.HardwareId.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.System.Profile.SystemManufacturers.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.System.RemoteDesktop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Immersive.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Input.Inking.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Search.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Xaml.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Web.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Windows.Web.Http.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WindowsCodecsExt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\windowslivelogin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winethc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinFax.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winhttp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wininet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wininit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wininitext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winipsec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Winlangdb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winlogon.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winlogonext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winmde.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winmm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winmmbase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinMsoIrmProtector.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winnsi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinOpcIrmProtector.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winrnr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winrs.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winrscmd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winrshost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winrssrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinRtTracing.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinSAT.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinSATAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinSCard.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinSetupUI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winshfhc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winsku.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winsockhc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winspool.drv:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WINSRPC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winsrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winsta.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinSync.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinSyncMetastore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinSyncProviders.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wintrust.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WinTypes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winusb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\winver.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wisp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\witnesswmiv2provider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wkscli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wkspbroker.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wkspbrokerAx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wksprt.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wksprtPS.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wkssvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlanapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlancfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WLanConn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlandlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlanext.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlangpui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WLanHC.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlanhlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlaninst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WlanMM.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlanmsm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlanpref.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WlanRadioManager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlansec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlansvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlansvcpal.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlanui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Wldap32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wldp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlgpclnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlidcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlidcredprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlidfdp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlidnsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlidprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlidsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wlrmdr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WlS0WndH.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMADMOD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMADMOE.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMALFXGFXDSP.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMASF.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmcodecdspps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmdmlog.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmdmps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmdrmdev.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmdrmnet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmdrmsdk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmiclnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmicmiplugin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmidcom.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmidx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmiprop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmitomi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMNetMgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMPDMC.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WmpDui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmpdxm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmpeffects.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmpmde.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmpps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmpshell.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmsgapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMSPDMOD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMSPDMOE.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMVCORE.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMVDECOD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wmvdspa.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMVENCOD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMVSDECD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMVSENCD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WMVXENCD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WofTasks.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WofUtil.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WorkFolders.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WorkfoldersControl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WorkFoldersGPExt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WorkFoldersShell.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\workfolderssvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wow64.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wowreg32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Wpc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wpccpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WpcMon.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wpcsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WpcWebSync.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wpdbusenum.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WpdMtp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WpdMtpUS.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WPDShextAutoplay.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WPDShServiceObj.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WPDSp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wpd_ci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wpnapps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wpncore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wpninprc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wpnpinst.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wpnprv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wpnsruprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\write.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ws2help.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\ws2_32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wscapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wscinterop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wscisvif.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSClient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSCollect.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wscproxystub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wscript.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wscsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wscui.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSDApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wsdchngr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSDMon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSDPrintProxy.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSDScanProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wsecedit.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wsepno.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wshbth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wshcon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wshelper.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wshext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wship6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wshirda.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wshnetbs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wshom.ocx:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wshqos.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wshrm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSHTCPIP.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WsmAgent.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSManHTTPConfig.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSManMigrationPlugin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WsmAuto.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wsmplpxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wsmprovhost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WsmSvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WsmWmiPl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wsnmp32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wsock32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wsqmcons.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSReset.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSShared.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSSync.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WSTPager.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wtsapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wu.upgrade.ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wuapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wuapp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wuauclt.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wuaueng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wucltux.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WUDFCoinstaller.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WUDFHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WUDFPlatform.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WUDFSvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WUDFx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WUDFx02000.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wudriver.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wups.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wups2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wusa.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WUSettingsProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wuwebv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WwaApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WWAHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WWanAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wwancfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wwanconn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WWanHC.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wwaninst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wwanmm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Wwanpref.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wwanprotdim.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\WwanRadioManager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wwansvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\wwapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\XAudio2_8.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xcopy.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\XInput1_4.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\XInput9_1_0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xmlfilter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xmllite.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xmlprovi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xolehlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\XpsFilt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\XpsGdiConverter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\XpsPrint.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\XpsRasterService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xpsrchvw.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xpsservices.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\XPSSHHDR.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xpssvcs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xwizard.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xwizards.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xwreg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xwtpdui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\xwtpw32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\zipfldr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\accessibilitycpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\acledit.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\aclui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\acppage.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ActionCenter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ActionCenterCPL.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\activeds.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\actxprxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\adprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\adsldp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\adsldpc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\adsmsext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\adsnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\adtschema.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\advapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\advpack.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\amstream.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\apds.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Apphlpdm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\appidapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\apprepapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\apprepsync.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\appwiz.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AppxAllUserStore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AppxApplicabilityEngine.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AppxPackaging.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AppxSip.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ARP.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\aspnet_counters.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\asycfilt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\at.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AtBroker.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\atl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\atlthunk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\atmfd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\atmlib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\attrib.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\audiodev.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioEng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AUDIOKSE.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioSes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\auditpol.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthBroker.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthExt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\authfwcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthFWGP.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthFWSnapin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthFWWizFwk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\autoconv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\autoplay.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\avicap32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\avifil32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\avrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\azroles.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\azroleui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\AzSqlExt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\backgroundTaskHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\BackgroundTransferHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\basecsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\batmeter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bcd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\BCP47Langs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bcrypt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bcryptprimitives.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bdaplgin.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bidispl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\BioCredProv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsadmin.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsperf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx3.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx4.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx5.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx7.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\biwinrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\blackbox.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\BluetoothApis.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bootcfg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\browcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\browseui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bthprops.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\bthudtask.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\btpanui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Bubbles.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\BWContextHandler.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ByteCodeGenerator.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cabinet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cabview.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cacls.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\calc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CallButtons.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CallButtons.ProxyStub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CameraSettingsUIHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\capiprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\capisp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\catsrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\catsrvps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\catsrvut.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cca.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cdosys.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\certca.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\certcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\certCredProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\certenc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CertEnroll.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CertEnrollCtrl.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CertEnrollUI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\certmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CertPolEng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\certreq.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\certutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cewmdm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cfgbkend.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cfgmgr32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cfmifs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cfmifsproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\charmap.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\chartv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\chcp.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CheckNetIsolation.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\chkdsk.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\chkntfs.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\choice.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CHxReadingStringIME.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cic.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cipher.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\clb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\clbcatq.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cleanmgr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\clfsw32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cliconfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cliconfg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\clip.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudNotifications.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudStorageWizard.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\clusapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmcfg32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmd.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmdext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmdial32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmdkey.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmdl32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmifw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmlua.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmmon32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmpbk32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmstp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmstplua.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cmutil.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cngcredui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cngprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cnvfat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\colbact.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\COLORCNV.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\colorcpl.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\colorui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\combase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\comcat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\comdlg32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\comp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\compact.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CompPkgSup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\compstui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ComputerDefaults.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\comrepl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\comsnap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\comsvcs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\comuid.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ConfigureExpandedStorage.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\connect.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ConnectedAccountState.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\console.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\control.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\convert.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CPFilters.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CredentialUIBroker.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\credssp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\credui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\credwiz.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptbase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptdlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptdll.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptnet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\CryptoWinRT.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\crypttpmeksvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptuiwizard.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptxml.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cscapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cscdll.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cscript.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ctfmon.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cttune.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\cttunesvr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\C_G18030.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\C_IS2022.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\C_ISCII.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d2d1.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10core.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10level9.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10warp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10_1.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10_1core.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d11.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d8.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d8thk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d9.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_43.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dim.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dim700.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dramp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dxof.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dabapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DafPrintProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DaOtpCredentialProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dataclen.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\davclnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\davhlpr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dbghelp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dbnetlib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dbnmpntw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dccw.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dciman32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dcomcnfg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dcomp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DDACLSys.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ddodiag.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DDOIProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DDORes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ddraw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ddrawex.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DefaultDeviceManager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DefaultPrinterProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\delegatorprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\desk.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\deskadp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\deskmon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DevDispItemProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\devenum.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\deviceaccess.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\deviceassociation.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceCenter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceDisplayStatusManager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DevicePairing.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DevicePairingFolder.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DevicePairingProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DevicePairingWizard.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceProperties.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceUxRes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\devmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\devobj.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\devrtl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dfrgui.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dfscli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DfsShlEx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcmonitor.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcore6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcsvc6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DHCPQEC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpsapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dialer.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\difxapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dimsjob.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dimsroam.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dinput.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dinput8.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\diskcomp.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\diskcopy.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\diskcopy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\diskpart.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\diskperf.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\diskraid.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dispex.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Display.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DisplaySwitch.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dllhost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dllhst3g.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dlnashext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmband.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmcompos.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmdlgs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmdskmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmime.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmintf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmloader.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmocx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmscript.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmstyle.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmsynth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmusic.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmutil.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmvdsitf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dmview.ocx:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dnsapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\docprop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\doskey.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3api.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3cfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3dlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3gpclnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3gpui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3hc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3msm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3ui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dpapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dpapimig.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dpapiprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DpiScaling.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dplaysvr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dplayx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dpmodemx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dpwsockx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\driverquery.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\drmmgrtn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\drmv2clt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\drprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\drt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\drtprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\drttransport.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\drvinst.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\drvstore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dsauth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dsdmo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dskquota.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dskquoui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dsound.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dsparse.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dsprop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dsquery.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dsrole.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dssec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dssenh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Dsui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dsuiext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dswave.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dtsh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dui70.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\duser.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dvdplay.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dvdupgrd.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dwmapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DWrite.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DWWIN.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dxcap.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dxcpl.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dxdiag.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dxdiagn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dxgi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dxmasf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\DxpTaskSync.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtmsft.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\dxva2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\eapp3hst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\eappcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\eappgnui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\eapphost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\eappprxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\eapprovp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\EAPQEC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\EaseOfAccessDialog.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\easwrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\efsadu.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\efscore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\efsui.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\efsutil.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\efswrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\EhStorAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\EhStorAuthn.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\EhStorPwdMgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\els.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ELSCore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\elshyph.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\elslad.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\elsTrans.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\encapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\EncDec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\eqossnap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\es.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\esent.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\esentprf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\esentutl.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\eudcedit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\eventcls.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\eventcreate.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\eventvwr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\evr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\expand.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\explorer.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ExplorerFrame.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\extrac32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Faultrep.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fdBth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fdBthProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FdDevQuery.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fde.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fdeploy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fdPnp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fdprint.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fdProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fdSSDP.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fdWCN.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fdWNet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fdWSD.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\feclient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\filemgmt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\find.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\findnetprinters.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\findstr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\finger.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FirewallAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FirewallControlPanel.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fixmapi.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerApp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fltLib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fltMC.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fmifs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fms.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Fondue.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fontext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fontsub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fontview.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\forfiles.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\format.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fphc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\framedyn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\framedynos.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\frprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fsutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fsutilext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ftp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fundisc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\fwcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FWPUCLNT.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FwRemoteSvr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSCOM.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSCOMEX.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSEXT32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSXP32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\g711codc.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\gameux.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\gcdef.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\gdi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\GdiPlus.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\GeofenceMonitorService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\getmac.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\getuname.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\glcndFilter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\glmf32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\GlobCollationHost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\globinputhost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\glu32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\gpapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\gpedit.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\gpprnext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\gpresult.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\gptext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\gpupdate.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\grpconv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hbaapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hcproviders.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hdwwiz.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hdwwiz.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\help.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\HelpPaneProxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hgcpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hh.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hhctrl.ocx:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hhsetup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hid.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hidphone.tsp:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hidserv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hnetcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\hnetmon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\HOSTNAME.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\httpapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\htui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ias.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iasacct.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iasads.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iasdatastore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iashlpr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\IasMigPlugin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iasnap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iaspolcy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iasrad.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iasrecst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iassam.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iassdo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iassvcs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\icacls.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iccvid.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\icm32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\icmui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\IconCodecService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\icsigd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\icsunattend.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\IdCtrls.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\idndl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\IDStore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ieapfltr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iedkcs32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iepeers.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ifmon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ifsutil.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ifsutilx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\imaadp32.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\imagehlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\imapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\imapi2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\imapi2fs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\imm32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcomm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\inetmib1.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\InfDefaultInstall.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\InkEd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\input.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\InputSwitch.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\instnm.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\intl.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ipconfig.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\IPHLPAPI.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iprop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iprtprio.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iprtrmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ipsecsnp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ipsmsnap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ir32_32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ir41_32.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ir41_qc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ir41_qcx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ir50_32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ir50_qc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ir50_qcx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\irclass.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\irprops.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsicli.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsicpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsicpl.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsidsc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsied.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsium.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsiwmi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsiwmiv2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\isoburn.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\itircl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\itss.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\iyuv_32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\joy.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9diag.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\kernel.appcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\kernel32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\KernelBase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\keyiso.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\keymgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\kmddsp.tsp:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\korwbrkr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ksproxy.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\kstvtune.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ksuser.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Kswdmcap.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ksxbar.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ktmutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ktmw32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\l2gpstore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\l2nacp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\L2SecHC.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\l3codeca.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\l3codecp.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\label.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\LAPRXY.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\LaunchTM.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\linkinfo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\loadperf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\localsec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\LocationApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\LocationNotifications.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\lodctr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\logagent.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\loghours.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\logman.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\logoncli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\lpk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\lsmproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\luainstall.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Magnification.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Magnify.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\main.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\makecab.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mapistub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MbaeApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MbaeApiPublic.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mbsmsapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mbussdapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mcbuilder.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mciavi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mcicda.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mciqtz32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mciseq.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mciwave.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mdminst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mdmregistration.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mf3216.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfAACEnc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfc42.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfc42u.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MFCaptureEngine.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfcsubs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfds.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfdvdec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfh264enc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MFMediaEngine.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmjpegdec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfnetcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfnetsrc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfplat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MFPlay.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfpmp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfreadwrite.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsrcsnk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsvr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mftranscode.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mfvdsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MFWMAAEC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mgmtapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mibincodec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Microsoft.Management.Infrastructure.Native.Unmanaged.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MicrosoftAccountTokenProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\midimap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\miguiresource.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mimefilt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mimofcodec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MirrorDrvCompat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mispace.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\miutils.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mlang.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mmc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcbase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mmci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcico.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcndmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcshext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MMDevAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mmsys.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mobsync.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mode.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\modemui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\more.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mountvol.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MP3DMOD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MP43DECD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MP4SDECD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Mpeg2Data.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mpg2splt.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MPG4DECD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mpr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mprapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mprddm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mprdim.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mprext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mprmsg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MRINFO.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MrmCoreR.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MrmIndexer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msaatext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSAC3ENC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msacm32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msacm32.drv:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msadp32.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msasn1.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSAudDecMFT.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msaudite.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mscandui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mscat32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mscms.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mscpxl32.dLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msctf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msctfime.ime:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MsCtfMonitor.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msctfp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msctfui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msctfuimanager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msdadiag.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msdart.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msdelta.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msdmo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msdrm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msdt.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msdtcprx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msdtcuiu.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSDvbNP.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msdxm.ocx:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeeds.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msftedit.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msg711.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msgsm32.acm:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtml.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MshtmlDac.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtmled.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msidcrl40.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msident.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msidle.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msieftp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msiexec.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msihnd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msiltcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msimg32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msimtf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msinfo32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msisip.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msiwer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mskeyprotcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mskeyprotect.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msls31.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSMPEG2ENC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msmpeg2vdec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msnetobj.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSNP.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msoeacct.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msoert2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msorcl32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mspaint.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mspatcha.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mspatchc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msports.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msra.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msrdc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MsRdpWebAccess.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msrle32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msscp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msscript.ocx:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mssha.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mssign32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mssip32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MsSpellCheckingHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mstask.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mstsc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mstscax.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msutb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msv1_0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msvcirt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msvcp60.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msvcrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msvfw32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msvidc32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVidCtl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVideoDSP.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msvproc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSWB7.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSWB70011.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSWB7001E.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSWB70404.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MSWB70804.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mswmdm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mswsock.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msxml3.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msxml6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\msyuv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mtstocom.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxclu.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxdm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxex.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxlegih.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxoci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\muifontsetup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\MuiUnattend.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mycomput.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\mydocs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Mystify.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\napdsnap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NapiNSP.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\napipsec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NAPMONTR.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NAPSTAT.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Narrator.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NaturalLanguage6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NcaApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NcdProp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\nci.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ncobjapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ncpa.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ncrypt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ncryptprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ncryptsslp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ndadmin.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\nddeapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ndfapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ndfetw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ndfhcdiscovery.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ndiscapCfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ndishc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ndproxystub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\negoexts.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\net.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\net1.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netbios.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netbtugc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netcenter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netcfgx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netcorehc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netdiagfx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netid.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netiohlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netiougc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netjoin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netlogon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netplwiz.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Netplwiz.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netprofm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netprovisionsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netsh.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netshell.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NETSTAT.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\netutils.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\networkexplorer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\networkitemfactory.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\newdev.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\newdev.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ninput.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NL7Data0011.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NL7Data001E.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NL7Data0404.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NL7Data0804.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\nlhtml.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\nlmgp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\nlmproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\nlmsprep.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0000.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0002.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0003.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0007.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0009.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData000a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData000c.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData000d.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData000f.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0010.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0018.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData001a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData001b.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData001d.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0020.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0021.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0022.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0024.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0026.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0027.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData002a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0039.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData003e.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0045.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0046.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0047.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0049.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData004a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData004b.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData004c.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData004e.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0414.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0416.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0816.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData081a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0c1a.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Nlsdl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsLexicons0009.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\normaliz.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\notepad.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\npmproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\nshhttp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\nshipsec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\nshwfp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\nsi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\nslookup.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ntasn1.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ntdsapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ntlanman.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ntlanui2.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ntmarta.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ntprint.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ntprint.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ntshrui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ntvdm64.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\objsel.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ocsetapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odbc32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcad32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcbcp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcconf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcconf.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odbccp32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odbccr32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odbccu32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcji32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcjt32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odbctrac.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\oddbse32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odexl32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odfox32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odpdx32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\odtext32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\OEMLicense.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\offfilt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\offreg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ogldrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ole32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\oleacc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\oleacchooks.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\oleaut32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\olecli32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\oledlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\oleprn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\olepro32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\olesvr32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\olethk32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\OnDemandConnRouteHelper.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\onex.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\onexui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\OobeFldr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\OpcServices.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\openfiles.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\opengl32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\OpenWith.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\osbaseln.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\osk.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\OskSupport.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\osuninst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\P2P.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\P2PGraph.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\p2pnetsh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\packager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PackageStateRoaming.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\panmap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PasswordOnWakeSettingFlyout.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PATHPING.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pautoenr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pcacli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pcaui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pcaui.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PCPKsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PCPTpm12.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pdh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pdhui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\perfctrs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\perfdisk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\perfmon.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\perfnet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\perfos.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\perfproc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\perfts.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PhotoScreensaver.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\photowiz.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PickerHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pid.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PING.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PkgMgr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pku2u.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pla.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\playlistfolder.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PlaySndSrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToDevice.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToManager.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToStatusProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pnrpnsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\polstore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\poqexec.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceClassExtension.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceConnectApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceStatus.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceSyncProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceTypes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceWiaCompat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceWMDRM.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pots.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\powercfg.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\powercfg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\powercpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\powrprof.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\prevhost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\print.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PrintConfig.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PrintDialogs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\printui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\printui.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\prncache.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\prnfldr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\prnntfy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\prntvpt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\profapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\profext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\propsys.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\proquota.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\provcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\provsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\provthrd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ProximityCommon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ProximityCommonPal.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ProximityRtapiPal.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\prvdmofcomp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\psapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\psisdecd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\psisrndr.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\PSModuleDiscoveryProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\psr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pstorec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\puiapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\puiobj.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\pwrshplugin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\QAGENT.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\qasf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\QCLIPROV.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\qdv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\qdvd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\qedit.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\qmgrprxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\QSHVHOST.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\QSVRMGMT.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\quartz.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Query.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\QUTIL.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\qwave.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RacEngn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\racpldlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\radardt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\radarrs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RADCUI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasadhlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasautou.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rascfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\raschap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\raschapext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasctrs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasdiag.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasdial.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasdlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\raserver.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasgcw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasman.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasmontr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasmxs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasphone.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasplap.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasppp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rasser.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rastls.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rastlsext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rdpcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rdpencom.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rdpendp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RdpSa.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RdpSaProxy.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RdpSaPs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RdpSaUacHelper.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rdrleakdiag.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rdvidcrl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rdvvmtransport.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ReAgent.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ReAgentc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\recover.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\reg.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\regapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RegCtrl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\regedit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\regedt32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\regini.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Register-CimProvider.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\regsvr32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ReInfo.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rekeywiz.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\relog.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\remotepg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\remotesp.tsp:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RemoveDeviceContextHandler.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RemoveDeviceElevated.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\replace.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RESAMPLEDMO.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\resmon.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RestoreOptIn.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\resutils.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Ribbons.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\riched20.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\riched32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RMActivate.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RMActivate_isv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RMActivate_ssp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RMActivate_ssp_isv.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RmClient.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rnr20.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Robocopy.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ROUTE.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rpchttp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RpcNs4.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rpcnsh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RpcPing.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rpcrt4.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RpcRtRemote.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rrinstaller.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rsaenh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rshx32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RstrtMgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rtffilt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rtm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rtutils.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RTWorkQ.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\runas.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\rundll32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\RunLegacyCPLElevated.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\runonce.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\samcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\samlib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sas.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sbe.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sbeio.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\scansetting.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SCardDlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\scecli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\scesrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\schedcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\schtasks.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\scksp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\scripto.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\scrnsave.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\scrobj.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\scrrun.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sdchange.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sdiageng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sdiagnhost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sdiagprv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sdohlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchFolder.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SecEdit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sechost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\secinit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\secproc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\secproc_isv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\secproc_ssp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\secproc_ssp_isv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\secur32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sendmail.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SensApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SensorsApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SensorsCpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\serialui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\serwvdrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SessEnv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sethc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingMonitor.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSync.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSyncCore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSyncHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSyncPolicy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\setup16.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\setupapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\setupcln.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\setupugc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\setx.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sfc.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sfc_os.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shacct.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SHCore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shdocvw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shfolder.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shgina.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shimgvw.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shlwapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shpafact.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shrpubw.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shsetup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shsvcs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shunimpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shutdown.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\shwebsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\signdrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SimAuth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SimCfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sisbkup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SkyDriveShell.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\slpts.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SmartcardCredentialProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SmartScreenSettings.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SMBHelperClass.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\smphost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SndVol.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SndVolSSO.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\snmpapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\softkbd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\softpub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sort.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SortServer2003Compat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SortWindows61.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SortWindows6Compat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\spbcd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\spfileq.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SPInf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\spnet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\spopk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\spp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\spwinsat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\spwizeng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\spwmp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sqlcecompact40.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sqlceoledb40.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sqlceqp40.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sqlcese40.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sqlsrv32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sqmapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\srchadmin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\srclient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\srumapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\srumsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\srvcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sscore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ssdpapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sspicli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SSShim.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ssText3d.scr:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Startupscan.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\stclient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sti.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\stobject.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\StorageContextHandler.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\storagewmi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\storagewmi_passthru.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Storprop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\StorSvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\StructuredQuery.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\subst.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sud.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\svchost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sxproxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sxs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sxshared.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sxsstore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sxstrace.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncCenter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\synceng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncHostps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncInfrastructure.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncInfrastructureps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Syncreg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\syncui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sysdm.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\syskey.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\sysmon.ocx:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\syssetup.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\systemcpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemEventsBrokerClient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\systeminfo.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesAdvanced.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesComputerName.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesDataExecutionPrevention.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesHardware.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesPerformance.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesProtection.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesRemote.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\systray.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\t2embed.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\takeown.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tapi3.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TapiMigPlugin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tapiperf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tapisrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TapiSysprep.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TapiUnattend.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\taskcomp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\taskeng.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\taskkill.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tasklist.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Taskmgr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\taskschd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TaskSchdPS.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tbs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tcmsetup.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tcpipcfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tcpmib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tcpmonui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TCPSVCS.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tdh.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\telephon.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\termmgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\themecpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\themeui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\threadpoolwinrt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\thumbcache.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ThumbnailExtractionHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TimeBrokerClient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\timedate.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TimeDateMUICallback.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\timeout.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tlscsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tpmcompc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TpmInit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tracerpt.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TRACERT.EXE:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\traffic.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tree.com:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tsbyuv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TSChannel.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tsgqec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tsmf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TSpkg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TSTheme.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TSWorkspace.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TtlsAuth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TtlsCfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\TtlsExt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tvratings.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\twext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\twinapi.appcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\twinapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.appcore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\txflog.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\txfw32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\typeperf.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\tzutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ucmhc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ucrtbase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\udhisapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\uexfat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ufat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\UIAnimation.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\uicom.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\uireng.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\UIRibbon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\UIRibbonRes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ulib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\umdmxfrm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\unimdm.tsp:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\unimdmat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\uniplat.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\unlodctr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\unrar.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\unregmp2.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\untfs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\upnp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\upnpcont.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\upnphost.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ureg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\urlmon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\usbceip.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\usbperf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\usbui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\user.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\user32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\UserAccountBroker.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\UserAccountControlSettings.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\UserAccountControlSettings.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\usercpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\userenv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\userinit.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\userinitext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\UserLanguageProfileCallback.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\usp10.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ustprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\utildll.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Utilman.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\uudf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\UXInit.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\uxlib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\uxtheme.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\VAN.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Vault.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vaultcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\VBICodec.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vbisurf.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vbscript.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vcamp140.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vdmdbg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vds_ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\verclsid.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\verifier.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\verifier.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\version.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vfwwdm32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vidcap.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\VIDRESZR.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\virtdisk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vpnikeapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\VscMgrPS.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vsd3dwarpdebug.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vsgraphicsremoteengine.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vsjitdebugger.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vssadmin.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vssapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vsstrace.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\vss_ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\w32tm.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\w32topl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WABSyncProvider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\waitfor.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wavemsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wbemcomn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wcmapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WcnApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wcnwiz.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WcsPlugInService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wdc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wdi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wdigest.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wdmaud.drv:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wdscore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WebcamUi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\webcheck.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WebClnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\webio.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\webservices.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Websocket.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wecapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wecutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFault.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFaultSecure.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wermgr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\werui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wevtapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wevtfwd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wevtutil.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wfapigp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wfdprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WfHC.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\where.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\whhelper.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\whoami.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wiaacmgr.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wiaaut.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wiadefui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wiadss.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wiascanprofiles.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wiashext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wiatrace.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wimgapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winbio.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winbrand.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wincorlib.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wincredprovider.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Background.SystemEventsBroker.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Background.TimeBroker.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Background.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Background.ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Custom.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Custom.ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Geolocation.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.PointOfService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Portable.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Printers.Extensions.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.SmartCards.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.WiFiDirect.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Globalization.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Globalization.Fontgroups.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Graphics.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Management.Workplace.WorkplaceSettings.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Devices.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.MediaControl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.SpeechSynthesis.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Streaming.ps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.HostName.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.NetworkOperators.HotspotAuthentication.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.Proximity.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.Sockets.PushEnabledApplication.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Security.Credentials.UI.CredentialPicker.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Security.Credentials.UI.UserConsentVerifier.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Storage.Compression.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.System.Display.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.System.Profile.HardwareId.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.System.Profile.SystemManufacturers.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.System.RemoteDesktop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Search.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Web.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Web.Http.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WindowsCodecsExt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\windowslivelogin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WinFax.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winhttp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wininet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wininitext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winipsec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Winlangdb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winmde.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winmm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winmmbase.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WinMsoIrmProtector.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winnsi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WinOpcIrmProtector.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winrnr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winrs.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winrscmd.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winrshost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winrssrv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WinRtTracing.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSATAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSCard.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winshfhc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winsku.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winsockhc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winspool.drv:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WINSRPC.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winsta.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSync.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSyncMetastore.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSyncProviders.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wintrust.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WinTypes.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winusb.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\winver.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wisp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wkscli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wkspbrokerAx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wksprtPS.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlancfg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WLanConn.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlandlg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanext.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlangpui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanhlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlaninst.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WlanMM.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanmsm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanpref.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlansec.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Wldap32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlgpclnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlidcli.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlidcredprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlidfdp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlidnsp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wlidprov.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WlS0WndH.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMADMOD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMADMOE.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMASF.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmcodecdspps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmdmlog.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmdmps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmdrmdev.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmdrmnet.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmdrmsdk.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmiclnt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmidcom.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmidx.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmiprop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmitomi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMNetMgr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMPDMC.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WmpDui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpdxm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpeffects.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpshell.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmsgapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMSPDMOD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMSPDMOE.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVCORE.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVDECOD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wmvdspa.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVENCOD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVSDECD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVSENCD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVXENCD.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wow32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wowreg32.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\Wpc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wpcsvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wpdshext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WPDShextAutoplay.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WPDShServiceObj.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WPDSp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wpnapps.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\write.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ws2help.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\ws2_32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wscapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wscinterop.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wscisvif.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WSClient.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wscproxystub.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wscript.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wscui.cpl:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WSDApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wsdchngr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wsecedit.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wshbth.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wshcon.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wshelper.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wshext.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wship6.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wshirda.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wshom.ocx:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wshqos.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wshrm.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WSHTCPIP.DLL:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAgent.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WSManHTTPConfig.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WSManMigrationPlugin.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAuto.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wsmplpxy.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wsmprovhost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmSvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmWmiPl.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wsnmp32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wsock32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WSShared.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WSSync.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WSTPager.ax:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wtsapi32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wuapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wuapp.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wudriver.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wups.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wusa.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wuwebv.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wvc.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WwaApi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WWAHost.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\WWanAPI.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\wwapi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_8.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xcopy.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\XInput1_4.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\XInput9_1_0.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xmlfilter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xmllite.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xmlprovi.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xolehlp.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\XpsFilt.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\XpsGdiConverter.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\XpsPrint.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\XpsRasterService.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xpsrchvw.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xpsservices.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\XPSSHHDR.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xpssvcs.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xwizard.exe:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xwizards.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xwreg.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xwtpdui.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\xwtpw32.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\SysWOW64\zipfldr.dll:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\acpi.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\agilevpn.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\appid.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\bridge.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\browserMon.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\bthenum.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\bthport.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\BTHUSB.SYS:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\Classpnp.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\clfs.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\cng.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\drmk.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\drmkaud.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\dxgkrnl.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\dxgmms1.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\fltMgr.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\fsdepends.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\http.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\i8042prt.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\kbdclass.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\kbdhid.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksecdd.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksecpkg.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\LGBusEnum.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\LGJoyXlCore.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\LGVirHid.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\massfilter_LTE.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\mouclass.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\mouhid.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\mountmgr.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\mpsdrv.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb20.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\mslldp.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndis.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndiscap.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\NdisImPlatform.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndistapi.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndproxy.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\Ndu.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\netbios.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\netvsc63.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\nsiproxy.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\ntfs.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\nwifi.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\pacer.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\partmgr.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\portcls.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\qwavedrv.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\rasacd.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\rassstp.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\refs.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\rmcast.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\rootmdm.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\scfilter.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\sermouse.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\spaceport.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\srv2.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\storport.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\swenum.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\tbs.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\tcpip.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\TsUsbGD.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\udfs.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbcir.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbscan.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\vhdmp.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmbkmcl.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmbus.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmstorfl.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\vpci.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\wanarp.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdBoot.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdFilter.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdNisDrv.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\wfplwfs.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\wimmount.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\winhv.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\wpcfltr.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\WUDFPf.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\WUDFRd.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\zgdcat.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\zgdcdiag.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\zgdcmdm.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\zgdcnet.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\zgdcnmea.sys:$CmdTcID AlternateDataStreams: C:\WINDOWS\system32\Drivers\zgdcvousb.sys:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Desktop\8svwje29.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Desktop\8svwje29.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Desktop\autoprezentacja-gydzmnupscrd.zip:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Desktop\dobredladziecka_kolorowanka_karmnik.jpg:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Desktop\EtContract.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Desktop\FRST64.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Desktop\FRST64.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Desktop\kolorowanki-liczenie-do-10.png:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Desktop\mastercook.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Desktop\menu.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\4026886_100012047714.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Addition_10-12-2015_20-17-43.txt:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\adwcleaner_5.015.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\adwcleaner_5.015.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Battle.net-Setup-plPL.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Battle.net-Setup-plPL.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\bbnd_so.pps:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\bibligrafia-M.doc:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\BitTorrent.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\BitTorrent.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\C5600_C5800Win7x64_PLK226_tcm3-36474.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\C5600_C5800Win7x64_PLK226_tcm3-36474.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\codeblocks-10.05mingw-setup.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\codeblocks-10.05mingw-setup.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\CurseClientSetup.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\CurseClientSetup.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\DAEMON-Tools-Lite-12708-dp.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\DAEMON-Tools-Lite-12708-dp.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Deklaracja_ubezpieczenie_Pracownicze__TYP_P_PLUS.doc:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\DTLite4454-0315.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\DTLite4454-0315.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\DTLiteInstaller (1).exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\DTLiteInstaller (1).exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\DTLiteInstaller.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\eduroam-W8-Uniwersytet_Warszawski.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\eduroam-W8-Uniwersytet_Warszawski.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\EtContract.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Faktura_DSL_0540_15.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Fallout 3 Intel bypass package-17209-1-1.zip:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Fallout 3.iso:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Fallout_3_spolszczenie_napisy.rar:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Fences2-cnet-setup.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Fences2-cnet-setup.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\flux-setup.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\flux-setup.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\instrukcja - mastercook 3400.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\iplasetup.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\iplasetup.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Kwestionariusz-ankiety2015.docx:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\LibreOffice_4.4.5_Win_x86.msi:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\LibreOffice_4.4.6_Win_x86.msi:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\masseffect_spolszczenie.rar:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\MEGAsyncSetup.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\MEGAsyncSetup.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Menu_Bingo.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\metody-walki-ze-stresem-lcawy8xahxze.zip:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\MS_Win8_v.7.7.pdf_tcm3-170814.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Opera_NI_stable.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Opera_NI_stable.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\O_Ch.pps:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Paszynska_Milena - Plan_rozwoju_zawodowego(1).doc:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Pedagogika porównawcza-konw..docx:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\plan_rozwoju_pawlikowska.doc:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\plan_rozwoju_zawodowego_iwona.doc:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Plus_Internet_ZTEMF821_poprawka.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Plus_Internet_ZTEMF821_poprawka.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\podanie.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\potwierdzenie-zamowienia1449778536267.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\pracownicy-pokolenia-y-raport-z-badan.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Program-szkolenia-i-terminy-zajec.doc:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\przelew (1).pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\przelew (2).pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\przelew.pdf:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\spotkanie-z-Milcią-Między-słowami.rar:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\SPTDinst-v187-x64.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\SPTDinst-v187-x64.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\szkolenie-29-X.doc:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\teksty_piosenek.doc:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\topic3.xls:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Unlocker-12240-dp.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Unlocker-12240-dp.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\Unlocker1.9.2.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\uwaga - czerwone światło.wma:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\vc_redist.x64.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\vc_redist.x64.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\vs_community.exe:$CmdTcID AlternateDataStreams: C:\Users\Patryk_2\Downloads\vs_community.exe:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\WARSZTATY - Harmonogram 2016.ods:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\zarzadzanie-soba-w-czasie--rublryxmvrp (1).zip:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\zarzadzanie-soba-w-czasie--rublryxmvrp.zip:$CmdZnID AlternateDataStreams: C:\Users\Patryk_2\Downloads\zip:$CmdZnID ==================== Tryb awaryjny (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Wartość "AlternateShell" zostanie przywrócona.) ==================== EXE - Powiązania (filtrowane) =============== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci.) ==================== Internet Explorer - Witryny zaufane i z ograniczeniami =============== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru.) ==================== Inne obszary ============================ (Obecnie brak automatycznej naprawy dla tej sekcji.) HKU\S-1-5-21-3680470863-837635135-2748872348-1009\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg DNS Servers: 192.168.0.249 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Zapora systemu Windows [funkcja włączona] ==================== MSCONFIG/TASK MANAGER - Wyłączone elementy == (Obecnie brak automatycznej naprawy dla tej sekcji.) HKLM\...\StartupApproved\StartupFolder: => "McAfee Security Scan Plus.lnk" HKLM\...\StartupApproved\StartupFolder: => "Stickies.lnk" HKLM\...\StartupApproved\Run: => "lxbkbmgr.exe" HKLM\...\StartupApproved\Run32: => "YouCam Tray" HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched" HKLM\...\StartupApproved\Run32: => "Plus Internet" HKLM\...\StartupApproved\Run32: => "YouCam Mirage" HKLM\...\StartupApproved\Run32: => "Adobe ARM" HKLM\...\StartupApproved\Run32: => "iTunesHelper" HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe" ==================== Reguły Zapory systemu Windows (filtrowane) =============== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [UDP Query User{9A4D497A-381C-463F-90E2-47CC8005CC26}C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe] => (Allow) C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe FirewallRules: [TCP Query User{7DF1420B-7C96-48BB-84E9-333F77A207F0}C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe] => (Allow) C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe FirewallRules: [{BB42BF94-DA28-40F4-A626-76E305454A8A}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe FirewallRules: [{C4D0502F-6C37-4DA6-88B6-83C0D4B3E518}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe FirewallRules: [UDP Query User{46174EB6-DA44-4C4B-AEA8-5BBB5F174A7D}C:\gry\ubisoft\ghost recon advanced warfighter\graw.exe] => (Block) C:\gry\ubisoft\ghost recon advanced warfighter\graw.exe FirewallRules: [TCP Query User{079A7F6A-0DAE-42F6-ABEC-827CCA6B3529}C:\gry\ubisoft\ghost recon advanced warfighter\graw.exe] => (Block) C:\gry\ubisoft\ghost recon advanced warfighter\graw.exe FirewallRules: [UDP Query User{EB44F413-EBDD-47C1-BE48-5E3540B19165}C:\gry\2k sports\nba 2k12\nba2k12.exe] => (Block) C:\gry\2k sports\nba 2k12\nba2k12.exe FirewallRules: [TCP Query User{AF651259-721A-4ACD-963D-E6B99FBDFEB0}C:\gry\2k sports\nba 2k12\nba2k12.exe] => (Block) C:\gry\2k sports\nba 2k12\nba2k12.exe FirewallRules: [{7605EEDF-753C-4040-A940-AD7E181D4D0D}] => (Allow) C:\Gry\Steam\SteamApps\common\Serious Sam HD The Second Encounter\Bin\SamHD_TSE_Unrestricted.exe FirewallRules: [{C824A9F0-14CE-4ABD-9004-6A745EAE0AA4}] => (Allow) C:\Gry\Steam\SteamApps\common\Serious Sam HD The Second Encounter\Bin\SamHD_TSE_Unrestricted.exe FirewallRules: [{36AD2219-0B7A-43CD-9DA0-5A8E59BBF85E}] => (Allow) C:\Gry\Steam\SteamApps\common\Serious Sam HD The Second Encounter\Bin\SamHD_TSE.exe FirewallRules: [{650CE6CE-EA46-41DB-BC33-C06938DC05F7}] => (Allow) C:\Gry\Steam\SteamApps\common\Serious Sam HD The Second Encounter\Bin\SamHD_TSE.exe FirewallRules: [{99FFF494-D8D9-4E87-BD0E-346E0A20DB2E}] => (Allow) C:\Gry\Steam\SteamApps\common\Total War SHOGUN 2\benchmarks\benchmark_specify_properties.bat FirewallRules: [{A3B379FA-D878-4A64-8623-5FA7A6BE0B58}] => (Allow) C:\Gry\Steam\SteamApps\common\Total War SHOGUN 2\benchmarks\benchmark_specify_properties.bat FirewallRules: [{B7707044-2DC9-479B-A07E-77868A0B6571}] => (Allow) C:\Gry\Steam\SteamApps\common\Total War SHOGUN 2\benchmarks\benchmark_current_settings.bat FirewallRules: [{67301F76-D7D7-4D19-85CF-6857FADE2194}] => (Allow) C:\Gry\Steam\SteamApps\common\Total War SHOGUN 2\benchmarks\benchmark_current_settings.bat FirewallRules: [{EB21EC0F-B2F7-4EC6-932B-6CB734EDDE3E}] => (Allow) C:\Gry\Steam\SteamApps\common\Total War SHOGUN 2\data\encyclopedia\how_to_play.html FirewallRules: [{E2EDAAF1-09E9-4D43-802D-6AAF56AD6A93}] => (Allow) C:\Gry\Steam\SteamApps\common\Total War SHOGUN 2\data\encyclopedia\how_to_play.html FirewallRules: [UDP Query User{B253C14D-0240-4C1E-A3A8-D1CCBDE76E73}C:\gry\steam\steam.exe] => (Block) C:\gry\steam\steam.exe FirewallRules: [TCP Query User{F6736454-9A2C-4C30-9469-314744BCEA0F}C:\gry\steam\steam.exe] => (Block) C:\gry\steam\steam.exe FirewallRules: [{54490F56-ECF9-4E01-80C1-436F247588CA}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe FirewallRules: [{806898CA-FF40-4CC7-8EDB-3A7482B8235D}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe FirewallRules: [{9F48FF64-732F-451C-B248-29010447C124}] => (Allow) C:\Gry\2K Sports\NBA 2K12\nba2k12.exe FirewallRules: [{8B27DD81-5F91-47CB-BCB9-6C41766E4D0C}] => (Allow) C:\Gry\2K Sports\NBA 2K12\nba2k12.exe FirewallRules: [{57D093F1-1AA8-4AC0-A837-A0A2F43220DE}] => (Allow) C:\Gry\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe FirewallRules: [{ECC489CC-638F-493B-AE22-1A55D6E8D23D}] => (Allow) C:\Gry\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe FirewallRules: [{A7DB478A-F2C2-40B8-95DC-29F65A8AB5EC}] => (Allow) C:\Gry\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe FirewallRules: [{B160DF44-8893-4D97-A0BE-76ED6DBD52E8}] => (Allow) C:\Gry\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe FirewallRules: [UDP Query User{99CC7F1B-7619-468B-B4C6-D7235AB48A3E}C:\gry\ubisoft\ghost recon advanced warfighter\graw.exe] => (Allow) C:\gry\ubisoft\ghost recon advanced warfighter\graw.exe FirewallRules: [TCP Query User{C8C60CD2-33F1-4122-957B-D2DAB5B79157}C:\gry\ubisoft\ghost recon advanced warfighter\graw.exe] => (Allow) C:\gry\ubisoft\ghost recon advanced warfighter\graw.exe FirewallRules: [{9C78A470-D0B0-4066-9F0F-867C17D9FAFB}] => (Allow) C:\Gry\Kalypso\Tropico 3\tropico3.exe FirewallRules: [{19D008FA-A2CE-4C60-9DAD-9726DF8E07B0}] => (Allow) C:\Gry\Kalypso\Tropico 3\tropico3.exe FirewallRules: [{6DB2682C-C385-4816-B888-9BF33C0126A0}] => (Allow) C:\Gry\Steam\Steam.exe FirewallRules: [{CB991F6F-0D99-4A14-9E83-D9B0EEC760C6}] => (Allow) C:\Gry\Steam\Steam.exe FirewallRules: [{576B9ACB-38FE-438C-B1D4-88E7BFF076D7}] => (Allow) C:\Program Files (x86)\Lenovo\PowerDVD10\PowerDVD10.EXE FirewallRules: [{EDFC2F00-A5EC-4B0A-BC11-C56EF6914A2D}] => (Allow) C:\Program Files (x86)\Lenovo\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe FirewallRules: [{61677F2F-577D-4B9B-AA8A-6C36B8B25406}] => (Allow) C:\Program Files (x86)\CDP Games\Ogniem i Mieczem Dzikie Pola\mb-oim.exe FirewallRules: [{91BABC59-0F7C-46A9-A17F-E76C3A9CEBB5}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe FirewallRules: [{2CEED57B-E1A4-4BEB-A88F-5D154257762C}] => (Allow) LPort=2869 FirewallRules: [{F403D59C-1551-4062-9FC2-A51600AD8A2B}] => (Allow) LPort=1900 FirewallRules: [{77D6744B-5346-4C27-A569-E0CA9D8C94A7}] => (Allow) C:\Gry\Steam\SteamApps\common\Serious Sam HD The Second Encounter\Bin\SamHD_TSE.exe FirewallRules: [{3C8715E6-9831-4594-890D-891C2613EB12}] => (Allow) C:\Gry\Steam\SteamApps\common\Serious Sam HD The Second Encounter\Bin\SamHD_TSE.exe FirewallRules: [{A187ACBC-EB5C-4074-8704-FDEDA18666A0}] => (Allow) C:\Gry\Steam\SteamApps\common\Serious Sam HD The Second Encounter\Bin\SamHD_TSE_Unrestricted.exe FirewallRules: [{A375B524-1B84-475E-BB49-AF653E4100AD}] => (Allow) C:\Gry\Steam\SteamApps\common\Serious Sam HD The Second Encounter\Bin\SamHD_TSE_Unrestricted.exe FirewallRules: [{35674BFB-A42C-427A-A39A-60AC40818E05}] => (Allow) C:\Program Files (x86)\WarThunder\launcher.exe FirewallRules: [{87DC3974-9060-4B0E-B4D0-5FAFC2265285}] => (Allow) C:\Program Files (x86)\WarThunder\launcher.exe FirewallRules: [TCP Query User{B4682FCC-CF46-41E1-A082-B125DC33ECAC}C:\program files (x86)\warthunder\aces.exe] => (Block) C:\program files (x86)\warthunder\aces.exe FirewallRules: [UDP Query User{A4C4C79D-AA50-48B1-A9BB-07B2337E08A4}C:\program files (x86)\warthunder\aces.exe] => (Block) C:\program files (x86)\warthunder\aces.exe FirewallRules: [TCP Query User{317588A6-77FF-48A2-8E40-DF802C512235}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Allow) C:\program files (x86)\libreoffice 4\program\soffice.bin FirewallRules: [UDP Query User{C0311888-8E15-48F9-8221-1B7DBF0C6C16}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Allow) C:\program files (x86)\libreoffice 4\program\soffice.bin FirewallRules: [{667A2260-694C-48DF-B5DB-EACB32CDEBAC}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe FirewallRules: [TCP Query User{F243C7A2-A387-4ACB-A0BB-5B6478145EF9}C:\program files (x86)\warthunder\aces.exe] => (Allow) C:\program files (x86)\warthunder\aces.exe FirewallRules: [UDP Query User{366CF42E-7650-4AA4-99E7-648973E60FD2}C:\program files (x86)\warthunder\aces.exe] => (Allow) C:\program files (x86)\warthunder\aces.exe FirewallRules: [{864967CD-60F1-4382-BC14-E68C9D8CD9A0}] => (Allow) C:\Windows\SysWOW64\lxbkcoms.exe FirewallRules: [{0CF94F51-323D-4671-A961-33A403B7E850}] => (Allow) C:\Windows\SysWOW64\lxbkcoms.exe FirewallRules: [{D8BE4D3F-3922-4EE2-B7EF-811B28B15DB8}] => (Allow) C:\Windows\System32\lxbkcoms.exe FirewallRules: [{972AFFC6-AA80-46A7-BC87-EC690E2F1C73}] => (Allow) C:\Windows\System32\lxbkcoms.exe FirewallRules: [{D6727143-8F9B-4A7B-B129-1635CA004646}] => (Allow) C:\Windows\System32\spool\drivers\x64\3\lxbkpswx.exe FirewallRules: [{13DF49C9-5270-4144-83F6-625FA76B7601}] => (Allow) C:\Windows\System32\spool\drivers\x64\3\lxbkpswx.exe FirewallRules: [TCP Query User{0B2EE596-8474-41A5-BF99-6DC6C62AB573}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Block) C:\program files (x86)\libreoffice 4\program\soffice.bin FirewallRules: [UDP Query User{F1711829-D054-49B5-ADB4-A5C8B59C2F2C}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Block) C:\program files (x86)\libreoffice 4\program\soffice.bin FirewallRules: [{F4E88691-C271-4685-97A8-4379BEC68DEB}] => (Allow) C:\Program Files (x86)\NapiProjekt\napisy.exe FirewallRules: [{A3A891A8-720B-47E5-BA9C-4A75AA530BA1}] => (Allow) C:\Program Files (x86)\NapiProjekt\napisy.exe FirewallRules: [{9C58C55A-772C-49FD-8057-4A9E61A4A1F7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{BDAD70E0-CF79-49F5-9396-980B44D79D96}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{8BE11C5A-F936-4E59-A135-C52B89B13DAB}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{6E214D48-8B7D-4C8B-8235-88CAA0624716}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{C86F4801-D5BA-43AB-8FE5-60FB8AB948CD}] => (Allow) C:\Gry\Steam\SteamApps\common\Sniper Elite V2\bin\SniperEliteV2.exe FirewallRules: [{1678D02B-07BA-4189-9335-B2F922A203E4}] => (Allow) C:\Gry\Steam\SteamApps\common\Sniper Elite V2\bin\SniperEliteV2.exe FirewallRules: [{F233E807-31AB-4DA6-8EA9-CBDB516F1BC4}] => (Allow) C:\Gry\Steam\SteamApps\common\Team Fortress 2\hl2.exe FirewallRules: [{9CA36D70-4A1D-4D1C-BDE1-42B7EC0C9BBE}] => (Allow) C:\Gry\Steam\SteamApps\common\Team Fortress 2\hl2.exe FirewallRules: [{5CFBCCE9-B907-4580-BE3A-4B228E35A05D}] => (Allow) C:\Gry\Steam\SteamApps\common\Marvel Heroes\UnrealEngine3\Binaries\Win32\MarvelHeroes2015.exe FirewallRules: [{FB5222A8-B794-438B-A538-8387BE20EFA1}] => (Allow) C:\Gry\Steam\SteamApps\common\Marvel Heroes\UnrealEngine3\Binaries\Win32\MarvelHeroes2015.exe FirewallRules: [TCP Query User{22B82F47-BC97-46AF-879F-B559B69E8D2C}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe FirewallRules: [UDP Query User{FE4A33AE-7B96-425B-B01F-9E89E57DB0D0}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe FirewallRules: [TCP Query User{D4B807F1-2DE1-4654-BC86-B2F49FCB16B7}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe FirewallRules: [UDP Query User{1E1FBFD4-5B2D-4589-9C23-82EFB5C2F136}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe FirewallRules: [{BD7C4AD5-C1BC-4A19-900F-C99DD2198D0E}] => (Allow) C:\Program Files (x86)\Origin Games\Dragon Age\bin_ship\daorigins.exe FirewallRules: [{217CA63E-6323-41FD-AE2A-C8F19C24F50A}] => (Allow) C:\Program Files (x86)\Origin Games\Dragon Age\bin_ship\daorigins.exe FirewallRules: [TCP Query User{3286713A-5263-4393-B39A-0F74CC1FFBF2}C:\program files (x86)\origin games\dragon age\bin_ship\daorigins.exe] => (Allow) C:\program files (x86)\origin games\dragon age\bin_ship\daorigins.exe FirewallRules: [UDP Query User{3ADEB491-D5A8-453F-AEB8-B142A3A85D64}C:\program files (x86)\origin games\dragon age\bin_ship\daorigins.exe] => (Allow) C:\program files (x86)\origin games\dragon age\bin_ship\daorigins.exe FirewallRules: [{BBE3E545-2ECB-4EC6-A8D6-CCC7523B02FA}] => (Allow) C:\Gry\Steam\bin\steamwebhelper.exe FirewallRules: [{323F8B7A-F542-4C14-BC2B-5FE2A352CD39}] => (Allow) C:\Gry\Steam\bin\steamwebhelper.exe FirewallRules: [{196F086C-B77E-4DF8-8ED7-DA0E4B8DF54B}] => (Allow) C:\Gry\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [{CB907320-ABF9-449E-BDA5-3D4E59A9F2B0}] => (Allow) C:\Gry\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [{7F475D94-4A01-488F-9E00-1340941D89F2}] => (Allow) C:\Program Files (x86)\Origin Games\SimCity 4 Deluxe Edition\Apps\SimCity 4.exe FirewallRules: [{E75F4F89-99DF-4C3B-80CC-981301D53CF1}] => (Allow) C:\Program Files (x86)\Origin Games\SimCity 4 Deluxe Edition\Apps\SimCity 4.exe FirewallRules: [{852C3B2D-F8D4-4A6E-B6B5-BAA532C7BA36}] => (Allow) C:\Gry\Steam\SteamApps\common\Sniper Elite V2\Launcher\SniperV2Launcher.exe FirewallRules: [{75B99D66-4A3A-4B66-935B-FC44DA881517}] => (Allow) C:\Gry\Steam\SteamApps\common\Sniper Elite V2\Launcher\SniperV2Launcher.exe FirewallRules: [TCP Query User{4D1D0FC6-5BA4-458B-8444-92C9EAA60EE2}C:\gry\steam\steamapps\common\counter-strike global offensive\csgo.exe] => (Allow) C:\gry\steam\steamapps\common\counter-strike global offensive\csgo.exe FirewallRules: [UDP Query User{89A24708-A33F-4DE3-B364-156D4EBCF5F5}C:\gry\steam\steamapps\common\counter-strike global offensive\csgo.exe] => (Allow) C:\gry\steam\steamapps\common\counter-strike global offensive\csgo.exe FirewallRules: [{6D63FA95-F032-4379-BAD0-80C3445003C6}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe FirewallRules: [{CF2F81CF-1C65-4F54-BC8C-F099439C732C}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe FirewallRules: [{E3031664-20AE-4D60-B18E-45A9B210A82F}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe FirewallRules: [{C5C94D6F-595A-4C87-A044-9AA7CA1AB1CF}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe FirewallRules: [TCP Query User{6AD97A08-336B-4DC5-8FDA-22A789AA4E2C}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe FirewallRules: [UDP Query User{582B148B-2934-4042-A879-0830094F7E51}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe FirewallRules: [TCP Query User{6485A16E-CA82-4164-AE8C-0A6C3E321AD4}C:\program files (x86)\origin games\crysis 2\bin32\crysis2.exe] => (Allow) C:\program files (x86)\origin games\crysis 2\bin32\crysis2.exe FirewallRules: [UDP Query User{6F31E4BA-41A0-4A13-9331-2ECD69550ABA}C:\program files (x86)\origin games\crysis 2\bin32\crysis2.exe] => (Allow) C:\program files (x86)\origin games\crysis 2\bin32\crysis2.exe FirewallRules: [TCP Query User{D922ADCE-41CE-43F7-B9B3-2BFD094165AF}C:\program files (x86)\origin games\crysis 2\bin32\crysis2.exe] => (Block) C:\program files (x86)\origin games\crysis 2\bin32\crysis2.exe FirewallRules: [UDP Query User{D3997DA9-0B12-420E-BA51-08F8A203F0DF}C:\program files (x86)\origin games\crysis 2\bin32\crysis2.exe] => (Block) C:\program files (x86)\origin games\crysis 2\bin32\crysis2.exe FirewallRules: [{6FF49689-6113-4569-8717-879CA6582D07}] => (Allow) C:\Gry\Steam\SteamApps\common\Blood Bowl Legendary Edition\BB_LE.exe FirewallRules: [{FFB14217-039A-464A-AABB-E87F06A594C4}] => (Allow) C:\Gry\Steam\SteamApps\common\Blood Bowl Legendary Edition\BB_LE.exe FirewallRules: [{064608DD-F168-4716-8015-62E9CA431C00}] => (Allow) C:\Program Files (x86)\Origin Games\FIFA 13\Game\fifa13.exe FirewallRules: [{2A7824AF-FAC1-4434-A0CE-E72CB36103CC}] => (Allow) C:\Program Files (x86)\Origin Games\FIFA 13\Game\fifa13.exe FirewallRules: [TCP Query User{8E2091EE-9E64-4858-8FD2-A5AFEC61E4D2}C:\program files (x86)\origin games\fifa 13\game\fifa13.exe] => (Allow) C:\program files (x86)\origin games\fifa 13\game\fifa13.exe FirewallRules: [UDP Query User{1B722C8F-5448-4B6A-BF0B-CDDD8F289CD5}C:\program files (x86)\origin games\fifa 13\game\fifa13.exe] => (Allow) C:\program files (x86)\origin games\fifa 13\game\fifa13.exe FirewallRules: [{16C97AAE-27A0-4973-B074-E9E9CD880065}] => (Allow) C:\Gry\Steam\SteamApps\common\Gems of War\GemsOfWar.exe FirewallRules: [{91FDE3F3-7A17-48FA-8669-532CE3008499}] => (Allow) C:\Gry\Steam\SteamApps\common\Gems of War\GemsOfWar.exe FirewallRules: [{BB03197F-A34A-4802-BCFD-F13CE40041AD}] => (Allow) C:\Gry\Steam\SteamApps\common\Dawn of War 2\DOW2.exe FirewallRules: [{A1344222-2C7D-4C9D-99EF-AC3D283E4B18}] => (Allow) C:\Gry\Steam\SteamApps\common\Dawn of War 2\DOW2.exe FirewallRules: [{187EB517-C578-48D2-8965-60024685A168}] => (Allow) C:\Gry\Steam\SteamApps\common\Total War SHOGUN 2\Shogun2.exe FirewallRules: [{41791BA9-8CAF-4B3F-982A-3DFDE90A3CE6}] => (Allow) C:\Gry\Steam\SteamApps\common\Total War SHOGUN 2\Shogun2.exe FirewallRules: [{3CA6ACCF-26A4-4BCF-8F91-3C6BF9B192A4}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe FirewallRules: [{4652ACAC-BE1D-439E-BDCC-2353F30441E3}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe FirewallRules: [TCP Query User{147091ED-C725-4334-B055-67BB5276C779}C:\program files (x86)\heroes of the storm\versions\base36144\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base36144\heroesofthestorm_x64.exe FirewallRules: [UDP Query User{515F42F6-02BB-4732-A92A-F88CCAC21A29}C:\program files (x86)\heroes of the storm\versions\base36144\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base36144\heroesofthestorm_x64.exe FirewallRules: [TCP Query User{2B0C428F-4E71-4D64-92F9-F58092B0151D}C:\program files (x86)\warthunder\launcher.exe] => (Allow) C:\program files (x86)\warthunder\launcher.exe FirewallRules: [UDP Query User{80271665-3D12-4A47-B70A-25F2D7B6CA9B}C:\program files (x86)\warthunder\launcher.exe] => (Allow) C:\program files (x86)\warthunder\launcher.exe FirewallRules: [TCP Query User{196BE590-CCCF-4FE8-8F5A-3616C5E56081}C:\program files\logitech gaming software\lcore.exe] => (Block) C:\program files\logitech gaming software\lcore.exe FirewallRules: [UDP Query User{A0EF8292-8169-490C-BFFB-256D5D4579D7}C:\program files\logitech gaming software\lcore.exe] => (Block) C:\program files\logitech gaming software\lcore.exe FirewallRules: [TCP Query User{DE25C077-C588-4B6C-8880-5AB4B32DE10F}C:\program files\logitech gaming software\lcore.exe] => (Allow) C:\program files\logitech gaming software\lcore.exe FirewallRules: [UDP Query User{A7E5BF3F-066B-48DB-937E-12346D8393DB}C:\program files\logitech gaming software\lcore.exe] => (Allow) C:\program files\logitech gaming software\lcore.exe FirewallRules: [{767F5A17-252D-4403-B399-E6D4F7A57211}] => (Allow) C:\Gry\Steam\SteamApps\common\KingArthurII\KingArthurII.exe FirewallRules: [{060653BB-E5A0-4169-9BA4-DF8D43C5B7A7}] => (Allow) C:\Gry\Steam\SteamApps\common\KingArthurII\KingArthurII.exe FirewallRules: [{E36B4E9D-E408-4C28-A489-C885B79F35AB}] => (Allow) C:\Gry\Steam\SteamApps\common\War Thunder\launcher.exe FirewallRules: [{7D33DD3C-F453-44DD-93B2-94C5C1D06027}] => (Allow) C:\Gry\Steam\SteamApps\common\War Thunder\launcher.exe FirewallRules: [TCP Query User{7D9F0789-6320-4B0D-ACBF-0DB3D83DCBB6}C:\gry\steam\steamapps\common\war thunder\aces.exe] => (Allow) C:\gry\steam\steamapps\common\war thunder\aces.exe FirewallRules: [UDP Query User{7450C9D6-3E8E-41C4-8BB0-F2AFF63510C8}C:\gry\steam\steamapps\common\war thunder\aces.exe] => (Allow) C:\gry\steam\steamapps\common\war thunder\aces.exe FirewallRules: [TCP Query User{3EE41357-C52D-4EAF-B3A1-73948039F44E}C:\program files (x86)\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe] => (Block) C:\program files (x86)\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe FirewallRules: [UDP Query User{03C34F88-DFE3-4B58-92FF-5D0FD8A0299D}C:\program files (x86)\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe] => (Block) C:\program files (x86)\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe FirewallRules: [TCP Query User{007A57C9-5A19-4AF0-A947-12DBC1D693F1}C:\program files (x86)\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe] => (Allow) C:\program files (x86)\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe FirewallRules: [UDP Query User{DED8F26B-649A-4D3F-92DC-62E7B9ADDEED}C:\program files (x86)\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe] => (Allow) C:\program files (x86)\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe FirewallRules: [{D5557AF4-4D9A-47DD-8E89-0CB72DE60F03}] => (Allow) C:\Users\Patryk_2\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{5CED32D4-3353-4620-B3A6-9F88EB113FA4}] => (Allow) C:\Users\Patryk_2\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{F5E5C056-42F8-410C-8ED2-F2F8E096C1A9}] => (Allow) C:\Users\Patryk_2\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{13C95CA4-0B7A-4765-ABE6-FEC6DD45CF2D}] => (Allow) C:\Users\Patryk_2\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{C174BECD-62F2-4361-84A7-C06B9CE23EF8}] => (Allow) C:\Users\Patryk_2\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{40599AA5-2251-4890-8D16-21A4A1E213F9}] => (Allow) C:\Users\Patryk_2\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{4F15809A-A5BD-4FA0-BDF6-CFDECBD511AB}] => (Allow) C:\Gry\Steam\SteamApps\common\Mass Effect\Binaries\MassEffect.exe FirewallRules: [{8485D5DC-08C8-4D98-8940-80CDFE75B722}] => (Allow) C:\Gry\Steam\SteamApps\common\Mass Effect\Binaries\MassEffect.exe FirewallRules: [{F0F4FB08-1E99-44F0-8234-8E6E1496DC4B}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe FirewallRules: [{F3871D63-5308-4B4B-BE7E-6AF1C4E52C73}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe FirewallRules: [{8818BF9F-535F-4BCC-82B4-184DBE2FB3BE}] => (Allow) C:\Games\Batman - Arkham City\Binaries\Win32\BatmanAC.exe FirewallRules: [{1A8CE3B0-0263-4D60-8CA9-CC60502A6883}] => (Allow) C:\Games\Batman - Arkham City\Binaries\Win32\BatmanAC.exe FirewallRules: [{419BC27B-D85F-49C2-975D-998B517A1112}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\devenv.exe FirewallRules: [TCP Query User{BC0D9FF1-4102-4B30-AFD8-B9C711643908}C:\program files (x86)\heroes of the storm\versions\base38793\heroesofthestorm_x64.exe] => (Block) C:\program files (x86)\heroes of the storm\versions\base38793\heroesofthestorm_x64.exe FirewallRules: [UDP Query User{3AA8606F-E8C4-4B91-92C2-7D5751130CEA}C:\program files (x86)\heroes of the storm\versions\base38793\heroesofthestorm_x64.exe] => (Block) C:\program files (x86)\heroes of the storm\versions\base38793\heroesofthestorm_x64.exe FirewallRules: [{308CC0C1-4EB2-4CD8-BC2A-4D43DCF03BA2}] => (Allow) C:\Gry\Steam\SteamApps\common\Lord of the Rings Online\TurbineInvoker.exe FirewallRules: [{F6350975-714A-4EAB-AA0A-97D3B0D589C8}] => (Allow) C:\Gry\Steam\SteamApps\common\Lord of the Rings Online\TurbineInvoker.exe FirewallRules: [TCP Query User{6049EA5F-BBCE-497C-89DC-59E0803A9E1B}C:\gry\steam\steamapps\common\lord of the rings online\lotroclient.exe] => (Allow) C:\gry\steam\steamapps\common\lord of the rings online\lotroclient.exe FirewallRules: [UDP Query User{C4CD522E-DB5E-4D05-AD1B-01A8270EAE21}C:\gry\steam\steamapps\common\lord of the rings online\lotroclient.exe] => (Allow) C:\gry\steam\steamapps\common\lord of the rings online\lotroclient.exe FirewallRules: [{986F4CB0-0C45-4C9F-846A-215A53857CF2}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Wadliwe urządzenia w Menedżerze urządzeń ============= Name: Bluetooth Audio Device Description: Bluetooth Audio Device Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318} Manufacturer: Qualcomm Atheros Communications Service: BTATH_A2DP Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. Name: Virtual Bluetooth Support (Include Audio) Description: Virtual Bluetooth Support (Include Audio) Class Guid: {c7c038ad-1f2d-44d4-b2fe-d912be20e6d5} Manufacturer: Qualcomm Atheros Communications Service: AthBTPort Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31) Resolution: Update the driver Name: Bluetooth LWFLT Device Description: Bluetooth LWFLT Device Class Guid: {c7c038ad-1f2d-44d4-b2fe-d912be20e6d5} Manufacturer: Qualcomm Atheros Communications Service: BTATH_LWFLT Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31) Resolution: Update the driver Name: Microsoft Visual Studio Location Simulator Sensor Description: Microsoft Visual Studio Location Simulator Sensor Class Guid: {5175d334-c371-4806-b3ba-71fd53c9258d} Manufacturer: Microsoft Corporation Service: SensorsSimulatorDriver Problem: : Windows has stopped this device because it has reported problems. (Code 43) Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. ==================== Błędy w Dzienniku zdarzeń: ========================= Dziennik Aplikacja: ================== Error: (12/11/2015 02:31:44 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: ) Description: Subscription licensing service failed: -1073415161 Error: (12/11/2015 09:44:34 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 1281 Error: (12/11/2015 09:44:34 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 1281 Error: (12/11/2015 09:44:34 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (12/10/2015 10:54:16 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 12812 Error: (12/10/2015 10:54:16 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 12812 Error: (12/10/2015 10:54:16 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (12/10/2015 09:47:59 PM) (Source: Windows Search Service) (EventID: 10021) (User: ) Description: Nie można uzyskać informacji rejestru licznika wydajności dla elementu WSearchIdxPi w wystąpieniu z powodu następującego błędu: Operacja ukończona pomyślnie. 0x0. Error: (12/10/2015 09:47:59 PM) (Source: Windows Search Service) (EventID: 3007) (User: ) Description: Nie można zainicjować monitorowania wydajności dla obiektu programu zbierającego, ponieważ liczniki nie są załadowane lub nie można otworzyć obiektu pamięci współużytkowanej. Wpływa to tylko na dostępność liczników monitora wydajności. Uruchom ponownie komputer. Kontekst: aplikacja , wykaz SystemIndex Error: (12/10/2015 09:47:58 PM) (Source: Windows Search Service) (EventID: 3006) (User: ) Description: Nie można zainicjować monitorowania wydajności dla usługi zbierającej, ponieważ liczniki nie są załadowane lub nie można otworzyć obiektu pamięci współużytkowanej. Wpływa to tylko na dostępność liczników monitora wydajności. Uruchom ponownie komputer. Dziennik System: ============= Error: (12/10/2015 09:47:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi Privacy Content Firewall z powodu następującego błędu: %%2 Error: (12/10/2015 09:47:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi Mobile Partner. OUC z powodu następującego błędu: %%1053 Error: (12/10/2015 09:47:39 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Upłynął limit czasu (30000 ms) podczas oczekiwania na połączenie się z usługą Mobile Partner. OUC. Error: (12/10/2015 09:46:19 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Usługa Usługa udostępniania w sieci programu Windows Media Player zależy od usługi Windows Search, której nie można uruchomić z powodu następującego błędu: %%3 Error: (12/10/2015 09:46:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi Windows Search z powodu następującego błędu: %%3 Error: (12/10/2015 09:46:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi Windows Search z powodu następującego błędu: %%3 Error: (12/10/2015 09:45:49 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Usługa Instalator modułów systemu Windows niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 120000 milisekund zostanie podjęta następująca czynność korekcyjna: Uruchom usługę ponownie. Error: (12/10/2015 09:45:49 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Usługa Usługa udostępniania w sieci programu Windows Media Player niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. W przeciągu 30000 milisekund zostanie podjęta następująca czynność korekcyjna: Uruchom usługę ponownie. Error: (12/10/2015 09:45:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Usługa Intel(R) Integrated Clock Controller Service - Intel(R) ICCS niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error: (12/10/2015 09:45:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Usługa Intel(R) Management and Security Application User Notification Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. CodeIntegrity: =================================== Date: 2015-12-11 14:44:26.524 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2015-12-11 14:35:44.915 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2015-12-10 22:28:26.314 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2015-12-10 21:49:00.803 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2015-12-10 21:40:48.406 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2015-12-10 21:34:12.274 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2015-12-10 21:21:29.117 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2015-12-10 21:06:43.648 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2015-12-10 20:55:52.698 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2015-12-10 20:42:31.877 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. ==================== Statystyki pamięci =========================== Procesor: Intel(R) Core(TM) i3-3110M CPU @ 2.40GHz Procent pamięci w użyciu: 58% Całkowita pamięć fizyczna: 3961.77 MB Dostępna pamięć fizyczna: 1633.21 MB Całkowita pamięć wirtualna: 5625.77 MB Dostępna pamięć wirtualna: 2841.31 MB ==================== Dyski ================================ Drive c: (Windows8_OS) (Fixed) (Total:883.84 GB) (Free:250.98 GB) NTFS ==>[system z komponentami startowymi (pozyskano odczytując dysk)] Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.7 GB) NTFS Drive e: (CD-Action 08-201) (CDROM) (Total:7.9 GB) (Free:0 GB) CDFS ==================== MBR & Tablica partycji ================== ======================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: DE09A172) Partition: GPT. ==================== Koniec Addition.txt ============================