Rezultaty skanu uzupełniającego Farbar Recovery Scan Tool (x64) Wersja: 30-09-2016 Uruchomiony przez Oliwia (02-10-2016 16:19:25) Uruchomiony z C:\Users\Oliwia\Desktop\ftps Windows 8.1 (Update) (X64) (2014-07-25 21:47:44) Tryb startu: Normal ========================================================== ==================== Konta użytkowników: ============================= Administrator (S-1-5-21-2577532048-60505754-3398219096-500 - Administrator - Disabled) Gość (S-1-5-21-2577532048-60505754-3398219096-501 - Limited - Disabled) Oliwia (S-1-5-21-2577532048-60505754-3398219096-1002 - Administrator - Enabled) => C:\Users\Oliwia UpdatusUser (S-1-5-21-2577532048-60505754-3398219096-1001 - Limited - Enabled) => C:\Users\UpdatusUser ==================== Centrum zabezpieczeń ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie.) AV: COMODO Antivirus (Enabled - Up to date) {D0CC7563-ABD2-DEBE-138E-FDD553335AF2} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Comodo Defense+ (Enabled - Up to date) {6BAD9487-8DE8-D130-293E-C6A728B4104F} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: COMODO Firewall (Enabled) {E8F7F446-E1BD-DFE6-38D1-54E0ADE01D89} ==================== Zainstalowane programy ====================== (W fixlist dozwolone tylko załączanie programów adware z flagą "Hidden" w celu ich uwidocznienia. Programy adware powinny zostać w poprawny sposób odinstalowane.) Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.162 - Adobe Systems Incorporated) Aktualizacje NVIDIA 1.15.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.15.2 - NVIDIA Corporation) Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.1.13 - ASUS) ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 1.1.3 - ASUS) ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0027 - ASUS) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) COMODO Internet Security Premium (HKLM\...\{5969857A-B3B6-4CB8-8AC0-240E1A099246}) (Version: 6.2.23257.2860 - COMODO Security Solutions Inc.) FormatFactory 3.3.4.0 (HKLM-x32\...\FormatFactory) (Version: 3.3.4.0 - Format Factory) Francuski 1000 najważniejszych słów i zwrotów (HKLM-x32\...\Francuski_1000_najwazniejszych_is1) (Version: - ) Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 6.0.7.1084 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3308 - Intel Corporation) Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{AD0F3D6D-202A-4BAB-8838-0134531FD3AF}) (Version: 15.5.6.0460 - Intel Corporation) Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{DA2600C1-6BDF-4FD1-8F3D-148929CC1385}) (Version: 2.6.1210.0278 - Intel Corporation) Intel(R) WiDi (HKLM\...\{6097158B-0184-4140-BEC3-7885794D2571}) (Version: 3.5.40.0 - Intel Corporation) iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.) Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Mozilla Firefox 49.0.1 (x86 pl) (HKLM-x32\...\Mozilla Firefox 49.0.1 (x86 pl)) (Version: 49.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 49.0.1.6109 - Mozilla) NapiProjekt (2.2.0.2399) (HKLM-x32\...\NapiProjekt_is1) (Version: - ) NVIDIA Oprogramowanie systemu PhysX 9.12.1031 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation) NVIDIA Sterownik dźwięku HD 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation) NVIDIA Sterownik graficzny 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation) Obsługa programów Apple (32-bitowa) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.) Obsługa programów Apple (64-bitowa) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.) Oprogramowanie Intel® PROSet/Wireless WiFi (HKLM\...\{1593C708-5535-47A4-8C0F-F8D4BE2B4560}) (Version: 15.05.6000.1657 - Intel Corporation) Pakiet sterowników systemu Windows - ASUS (ATP) Mouse (01/10/2013 1.0.0.170) (HKLM\...\4A9DE1E9EBC800B7F01739D4DE7363EF6751BDF5) (Version: 01/10/2013 1.0.0.170 - ASUS) Panel sterowania NVIDIA 331.65 (Version: 331.65 - NVIDIA Corporation) Hidden Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6829 - Realtek Semiconductor Corp.) Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.8400.27023 - Realtek Semiconductor Corp.) Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.112 - Skype Technologies S.A.) TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.28223 - TeamViewer) VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN) WinRAR 5.00 (64-bitowy) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH) WinRAR 5.01 (32-bitowy) (HKLM-x32\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH) YouTube Downloader (HKLM-x32\...\{f2f7fdc0-0bf6-45b6-9821-2b4163a8e92b}) (Version: 1.0.0.2 - Flex Media Limited) YouTube Downloader (x32 Version: 1.0000 - Frappsy) Hidden ==================== Niestandardowe rejestracje CLSID (filtrowane): ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Zaplanowane zadania (filtrowane) ============= (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList Task: {145EC74F-BEFC-4F9A-A7AB-89C410AEEC6B} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-28] (COMODO) Task: {3E74F226-20A0-4FA7-923A-D638DA60C420} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-28] (COMODO) Task: {49806A40-86A6-4650-B3A6-45EE336F6668} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-01-14] (Apple Inc.) Task: {569CAC6A-EE8A-4617-84A4-8972FF4F52C0} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-28] (COMODO) Task: {597FB626-F699-4A26-AB35-8640F215D971} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-28] (COMODO) Task: {732D7E96-52F1-4364-9D41-9EAF7358CD24} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2013-01-16] (AsusTek) Task: {BB5D5C3F-89A9-4CFE-9245-28BB1B6590D2} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-09-15] (Microsoft Corporation) Task: {E12D4820-814F-47CC-A66E-7E2CF0523D43} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2016-09-26] (COMODO) Task: {F1DC6FE2-665D-4B59-802B-EC09A7D173AB} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2016-09-26] (COMODO) Task: {FB0017DD-137F-4F74-8B57-C43D83C198B7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-09-13] (Adobe Systems Incorporated) (Załączenie wejścia w fixlist spowoduje przesunięcie pliku zadania (.job). Plik uruchamiany docelowo przez zadanie nie zostanie przeniesiony.) Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Skróty ============================= (Wybrane wejścia mogą zostać załączone w celu ich zresetowania lub usunięcia.) ==================== Załadowane moduły (filtrowane) ============== 2015-03-20 18:12 - 2015-03-20 18:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2015-03-20 18:12 - 2015-03-20 18:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2013-04-15 18:39 - 2016-03-16 12:25 - 00073912 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav 2013-12-10 08:13 - 2013-12-10 08:13 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll 2014-07-25 23:17 - 2013-10-23 10:20 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2010-01-30 02:40 - 2010-01-30 02:40 - 04254560 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2012-12-13 02:38 - 2012-12-13 02:38 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2013-08-31 19:51 - 2014-05-06 22:48 - 00559016 _____ () C:\Users\Oliwia\AppData\Local\Frappsy\YouTube Downloader\YouTubeDownloader.exe 2013-05-10 15:38 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll 2013-12-10 08:13 - 2013-12-10 08:13 - 00013088 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll ==================== Alternate Data Streams (filtrowane) ========= (Załączenie wejścia w fixlist spowoduje usunięcie strumienia ADS.) AlternateDataStreams: C:\WINDOWS\explorer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\HelpPane.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\hh.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\notepad.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\regedit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\splwow64.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\twain_32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\winhlp32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\write.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\accessibilitycpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\acledit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aclui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\acmigration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\acppage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\acproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ActionCenter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ActionCenterCPL.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ActionQueue.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\activeds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\actxprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\adhapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\adhsvc.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\adprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\adsldp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\adsldpc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\adsmsext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\adsnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\adtschema.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\advapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\advpack.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aecache.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aeinv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aelupsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aepic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AepRoam.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aitagent.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aitstatic.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\alg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AltTab.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\amstream.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\apds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\apphelp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Apphlpdm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appidapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appidcertstorecheck.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appidpolicyconverter.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appidsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appinfo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appraiser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppReadiness.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\apprepapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\apprepsync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appsruprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appwiz.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppxAllUserStore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppxApplicabilityEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentExtensions.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentServer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppxPackaging.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppxSip.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppxStreamingDataSourcePS.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppxSysprep.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ARP.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aspnet_counters.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\asycfilt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\at.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AtBroker.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atlthunk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atmfd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atmlib.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\attrib.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\audiodg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AudioEndpointBuilder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AudioEng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AUDIOKSE.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AudioSes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\audiosrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\auditcse.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\auditpol.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AuthBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AuthExt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\authfwcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AuthFWGP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AuthFWSnapin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AuthFWWizFwk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AuthHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AuthHostProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\authui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\authz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\autoconv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\autoplay.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AutoWorkplaceN.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\avicap32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\avifil32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\avrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AxInstSv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AxInstUI.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\azroles.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\azroleui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AzSqlExt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\backgroundTaskHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BackgroundTransferHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\basecsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\basesrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\batmeter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bcd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bcdboot.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bcdedit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bcdprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bcdsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BCP47Langs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bcrypt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bcryptprimitives.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bdaplgin.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BdeHdCfgLib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bderepair.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bdesvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bdeui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BdeUISrv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bdeunlock.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BFE.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bidispl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BioCredProv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bisrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BitLockerDeviceEncryption.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BitLockerWizardElev.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bitsadmin.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bitsigd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bitsperf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bitsprx2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bitsprx3.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bitsprx4.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bitsprx5.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bitsprx6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bitsprx7.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\biwinrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\blackbox.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\blb_ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BluetoothApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bootcfg.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\bootim.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BootMenuUX.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bootsect.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bootux.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\brdgcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bridgeunattend.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BrokerLib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\browcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\browser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\browseui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bthci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BthHFSrv.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\BthMtpContextHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bthpanapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BthpanContextHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bthprops.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BthRadioMedia.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bthserv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BthSQM.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bthudtask.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\btpanui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Bubbles.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BulkOperationHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BWContextHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ByteCodeGenerator.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cabinet.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\cabview.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cacls.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\calc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CallButtons.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CallButtons.ProxyStub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CameraSettingsUIHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\capiprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\capisp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\catsrv.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\catsrvps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\catsrvut.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cca.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cdd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cdosys.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\centel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\certca.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\certcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\certCredProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\certenc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CertEnroll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CertEnrollCtrl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CertEnrollUI.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\certmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CertPolEng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\certprop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\certreq.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\certutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cewmdm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cfgbkend.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cfgmgr32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cfmifs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cfmifsproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\charmap.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\chartv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\chcp.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CheckNetIsolation.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\chkdsk.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\chkntfs.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\chkwudrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\choice.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CHxReadingStringIME.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cipher.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CIRCoInst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\clb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\clbcatq.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cleanmgr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\clfsw32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cliconfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cliconfg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\clip.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CloudNotifications.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CloudStorageWizard.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\clusapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmcfg32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmd.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\cmdext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmdial32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmdkey.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmdl32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmifw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmlua.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmmon32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmpbk32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmstp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmstplua.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmutil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cngcredui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cngprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cnvfat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cofire.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cofiredm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\colbact.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\COLORCNV.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\colorcpl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\colorui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\combase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\comcat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\comctl32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\comdlg32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\comp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\compact.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CompatTelRunner.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CompMgmtLauncher.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\CompPkgSup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\compstui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ComputerDefaults.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\comrepl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\comsnap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\comsvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\comuid.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ConfigureExpandedStorage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\conhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\connect.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ConnectedAccountState.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\consent.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ConsentUX.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\console.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\control.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\convert.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\correngine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CPFilters.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CredentialMigrationHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CredentialUIBroker.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\credssp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\credui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\credwiz.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\crypt32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptbase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptcatsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptdlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptdll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptnet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CryptoWinRT.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\crypttpmeksvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptui.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\cryptuiwizard.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptxml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cscapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cscdll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cscript.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\csrsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CSystemEventsBrokerClient.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\ctfmon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cttune.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cttunesvr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\C_G18030.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\C_IS2022.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\C_ISCII.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d2d1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d10.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d10core.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d10level9.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d10warp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d10_1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d10_1core.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d11.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d8thk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d9.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_47.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dab.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dabapi.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\DAConn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dafBth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DafPrintProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dafupnp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dafWCN.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dafWfdProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DAFWSD.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DAMM.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DaOtpCredentialProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\das.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dasHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dataclen.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\datusage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\davclnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\davhlpr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dbgeng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dbghelp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dbnetlib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dbnmpntw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dccw.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dciman32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dcomcnfg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dcomp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DDACLSys.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ddodiag.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DDOIProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DDORes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ddraw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ddrawex.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DefaultDeviceManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DefaultPrinterProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Defrag.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\defragproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\defragsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\delegatorprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\desk.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\deskadp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\deskmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DevDispItemProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\devenum.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\deviceaccess.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\deviceassociation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceCenter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceDisplayStatusManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceDriverRetrievalClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceEject.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceElementSource.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceMetadataRetrievalClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DevicePairing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DevicePairingFolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DevicePairingProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DevicePairingWizard.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceProperties.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\deviceregistration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceSetupManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceSetupManagerAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceUxRes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\devinv.dll:$CmdTcID [32] AlternateDataStreams: C:\WINDOWS\system32\devmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\devobj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DevPropMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\devrtl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dfdts.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DFDWiz.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\dfp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DfpCommon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dfrgui.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dfscli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DfsShlEx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dhcpcmonitor.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dhcpcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dhcpcore6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dhcpcsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dhcpcsvc6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DHCPQEC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dhcpsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DiagCpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\diagperf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\diagtrack.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dialer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\difxapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dimsjob.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\dimsroam.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dinput.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dinput8.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\discan.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\diskcomp.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\diskcopy.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\diskcopy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\diskpart.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\diskperf.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\diskraid.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dispci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dispdiag.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dispex.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Display.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DisplaySwitch.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\djoin.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\dllhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dllhst3g.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dlnashext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmdlgs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmdskmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmintf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmloader.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmocx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DMRServer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmsynth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmusic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmutil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmvdsitf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmview.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dns-sd.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dnsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dnscacheugc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dnsext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dnshc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dnsrslvr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\docprop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\doskey.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dot3api.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dot3cfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Dot3Conn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dot3dlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dot3gpclnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dot3gpui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dot3hc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dot3mm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dot3msm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dot3svc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dot3ui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dpapimig.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dpapiprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dpapisrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DpiScaling.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\driverquery.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\drmmgrtn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\drmv2clt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\drprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\drt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\drtprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\drttransport.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\drvcfg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\drvinst.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\drvstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dsauth.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\DscCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DscCoreConfProv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dsdmo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dskquota.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dskquoui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DsmUserTask.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dsound.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dsparse.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dsprop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dsquery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dsrole.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dssec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dssenh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Dsui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dsuiext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dswave.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dtsh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dui70.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\duser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dvdplay.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dvdupgrd.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dwm.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dwmapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dwmcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dwmredir.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DWrite.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\DWWIN.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dxdiag.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dxdiagn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dxgi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dxgwdi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dxmasf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DXP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dxpps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Dxpserver.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DxpTaskSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dxtmsft.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dxtrans.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dxva2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Eap3Host.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eapp3hst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eappcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eappgnui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eapphost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eappprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eapprovp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EAPQEC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eapsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\easconsent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EaseOfAccessDialog.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\easinvoker.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\easinvoker.proxystub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\easwrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\efsadu.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\efscore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\efslsaext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\efssvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\efsui.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\efsutil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\efswrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EhStorAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EhStorAuthn.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EhStorPwdMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EhStorShell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\els.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ELSCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\elshyph.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\elslad.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\elsTrans.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\encapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EncDec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EncDump.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\energy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\energyprov.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\energytask.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eqossnap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\es.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\esent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\esentprf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\esentutl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eudcedit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EventAggregation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eventcls.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eventcreate.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\eventvwr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\evr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\expand.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ExplorerFrame.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\extrac32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Faultrep.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fdBth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fdBthProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FdDevQuery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fde.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fdeploy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fdPHost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fdPnp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fdprint.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fdProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FDResPub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fdSSDP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fdWCN.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fdWNet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fdWSD.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\feclient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhautoplay.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhcat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhcleanup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhengine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhevents.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhlisten.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhmanagew.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhshl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhsrchapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhsrchph.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhsvcctl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhtask.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FileAppxStreamingDataSource.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\filemgmt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\find.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\findnetprinters.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\findstr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\finger.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Firewall.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FirewallAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FirewallControlPanel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fixmapi.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fltLib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fltMC.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fmapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fmifs.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\fms.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FntCache.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Fondue.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fontext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fontsub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fontview.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\forfiles.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\format.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fphc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\framedyn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\framedynos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\frprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fsavailux.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fsquirt.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fsutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fsutilext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fthsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ftp.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\fundisc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fveapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fveapibase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fvecerts.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fvecpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fvenotify.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fveskybackup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fveui.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\fvewiz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fwcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FWPUCLNT.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FwRemoteSvr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXSAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXSCOM.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXSCOMEX.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXSCOMPOSE.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXSCOVER.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXSMON.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXSROUTE.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXSST.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\FXSSVC.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXST30.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXSTIFF.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXSUNATD.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FXSUTILITY.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\g711codc.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gacinstall.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gameux.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gcdef.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gdi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\GdiPlus.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\GEARAspi64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\generaltel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\GeofenceMonitorService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\getmac.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\getuname.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\glcndFilter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\glmf32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\GlobCollationHost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\globinputhost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\glu32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gpedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gpprnext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gpresult.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gpsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gptext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gpupdate.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Groupinghc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\grpconv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hbaapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hcproviders.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hdwwiz.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hdwwiz.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\help.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\HelpPaneProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hgcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hgprint.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hhctrl.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hhsetup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hid.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hidphone.tsp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hidserv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hlink.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hnetcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hnetmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\HOSTNAME.EXE:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\hotplug.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hotspotauth.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\httpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\httpprxm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\httpprxp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\htui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hwrcomp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hwrreg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ias.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iasacct.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iasads.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iasdatastore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iashlpr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\IasMigPlugin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iasnap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iaspolcy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iasrad.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iasrecst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iassam.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iassdo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iassvcs.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\icacls.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\icfupgd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\icm32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\icmui.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\IconCodecService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\icsigd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\icsunattend.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\icsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\IdCtrls.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\IdListen.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\idndl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\IDStore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ie4uinit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ieapfltr.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\iedkcs32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ieframe.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iepeers.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\iertutil.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\ieui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ifmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ifsutil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ifsutilx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\igdDiag.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\IKEEXT.DLL:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\imaadp32.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\imagehlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\imapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\imapi2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\imapi2fs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\imm32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\immersivetpmvscmgrsvr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\inetcomm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\inetcpl.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\inetmib1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\inetpp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\inetppui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\InfDefaultInstall.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\InkEd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\input.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\InputSwitch.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\inseng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\intl.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\invagent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ipconfig.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\IPHLPAPI.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iphlpsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ipnathlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iprtprio.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iprtrmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ipsecsnp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\IPSECSVC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ipsmsnap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\irclass.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\irftp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\irmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\irprops.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iscsicli.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iscsicpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iscsicpl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iscsidsc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iscsied.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iscsiexe.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iscsium.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iscsiwmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iscsiwmiv2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\isoburn.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\itircl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\itss.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iuilp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iyuv_32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\joy.cpl:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\jscript.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\jscript9.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\jscript9diag.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\KdsCli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\kdusb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\kd_02_8086.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\keepaliveprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\kerberos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\kernel.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\kernel32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\KernelBase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\kernelceip.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\keyiso.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\keymgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\klist.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\kmddsp.tsp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\KMSVC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\korwbrkr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ksetup.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ksproxy.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\kstvtune.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ksuser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Kswdmcap.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ksxbar.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ktmutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ktmw32.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\l2gpstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\l2nacp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\L2SecHC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\l3codeca.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\l3codecp.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\label.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LangCleanupSysprepAction.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LAPRXY.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LaunchTM.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\linkinfo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ListSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\livessp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LldpNotify.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lltdapi.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\lltdsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lmhsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\loadperf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\localsec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\localspl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\localui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LocationApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LocationNotifications.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Locator.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LockScreenContent.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\LockScreenContentHost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lodctr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\logagent.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\loghours.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\logman.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\logoncli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LogonUI.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lpk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lpkinstall.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lpksetup.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lpksetupproxyserv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lpremove.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lsasrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lsass.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lsm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lsmproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\luainstall.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Magnification.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Magnify.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\main.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MaintenanceUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\makecab.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\manage-bde.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mapistub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MbaeApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MbaeApiPublic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MbaeParserTask.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MbaeXmlParser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mblctr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mbsmsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mbussdapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mcbuilder.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mciavi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mcicda.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mciqtz32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mciseq.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mciwave.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mcupdate_GenuineIntel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\McxDriv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MDEServer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MDMAgent.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mdminst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mdmregistration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MdRes.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MdSched.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MemoryDiagnostic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mf3216.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfAACEnc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfasfsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfc42.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfc42u.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MFCaptureEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfcsubs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfdvdec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfh264enc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MFMediaEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfmjpegdec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfmp4srcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfmpeg2srcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfnetcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfnetsrc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfplat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MFPlay.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfpmp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfreadwrite.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfsvr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mftranscode.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfvdsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MFWMAAEC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mgmtapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mibincodec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Microsoft.Management.Infrastructure.Native.Unmanaged.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MicrosoftAccountTokenProvider.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\midimap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\migflt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\miguiresource.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mimefilt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mimofcodec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MirrorDrvCompat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mispace.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\miutils.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mlang.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\mmc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mmcbase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mmci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mmcico.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mmcndmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mmcshext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mmcss.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MMDevAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mmsys.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mobsync.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mode.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\modemui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\montr_ci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\more.com:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\mountvol.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MP3DMOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MP43DECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MP4SDECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Mpeg2Data.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mpg2splt.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MPG4DECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mpnotify.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mpr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mprapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mprddm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mprdim.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mprext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mprmsg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MPSSVC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MRINFO.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MrmCoreR.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MrmIndexer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MRT.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\msaatext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSAC3ENC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msacm32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msacm32.drv:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msadp32.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msasn1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSAudDecMFT.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msaudite.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msauserext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mscandui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mscat32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msched.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSchedExe.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mscms.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msconfig.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msctf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msctfime.ime:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MsCtfMonitor.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msctfp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msctfui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msctfuimanager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdadiag.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdart.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdelta.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdmo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdri.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\msdrm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdt.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdtc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdtckrm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdtclog.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdtcprx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdtctm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdtcuiu.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSDvbNP.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdxm.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msfeeds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msftedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msg711.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msgsm32.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mshtml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MshtmlDac.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mshtmled.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MsiCofire.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msidcrl40.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msident.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msidle.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\msieftp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msiexec.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msihnd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msiltcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msimg32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msimtf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msinfo32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msisip.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msiwer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mskeyprotcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mskeyprotect.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msls31.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\msmpeg2adec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSMPEG2ENC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msmpeg2vdec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msnetobj.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\MSNP.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msoeacct.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msoert2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mspaint.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mspatcha.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mspatchc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msports.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msra.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msrahc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msrating.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msrdc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MsRdpWebAccess.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msrle32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msscntrs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msscp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssha.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msshooks.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\mssign32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssip32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssitlb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MsSpellCheckingFacility.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MsSpellCheckingHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssph.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssphtb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssrch.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssvp.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\mstask.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msTextPrediction.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mstsc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mstscax.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msutb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msv1_0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msvcirt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msvcp60.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msvcrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msvfw32.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\msvidc32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSVidCtl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSVideoDSP.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\msvproc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSWB7.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSWB70011.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSWB7001E.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\MSWB70404.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSWB70804.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mswmdm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mswsock.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msxml3.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msxml6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msyuv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mtstocom.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mtxclu.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mtxdm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mtxex.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mtxoci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\muifontsetup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MUILanguageCleanup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MuiUnattend.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MultiDigiMon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mycomput.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mydocs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Mystify.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\napdsnap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NapiNSP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\napipsec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NAPMONTR.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NAPSTAT.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Narrator.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NaturalLanguage6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nbtstat.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NcaApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NcaSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ncbservice.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NcdAutoSetup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NcdProp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ncobjapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ncpa.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ncrypt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ncryptprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ncryptsslp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ncsi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ncuprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ndadmin.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nddeapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ndfapi.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\ndfetw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ndfhcdiscovery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ndiscapCfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ndishc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NdisImPlatform.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ndproxystub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nduprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\negoexts.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\net.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\net1.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netbios.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netbtugc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netcenter.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\netcfg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netcfgx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netcorehc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netdiagfx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NetEvtFwdr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netid.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netiohlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netiougc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netjoin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netlogon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netman.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netplwiz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Netplwiz.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netprofm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netprofmsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netprovisionsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NetSetupApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netsh.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netshell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NETSTAT.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nettrace.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\netutils.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NetVscCoinstall.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\networkexplorer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\networkitemfactory.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NetworkStatus.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\newdev.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\newdev.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ninput.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NL7Data0011.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NL7Data001E.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NL7Data0404.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NL7Data0804.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nlaapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nlahc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nlasvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nlhtml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nlmgp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nlmproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nlmsprep.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0000.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0002.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0003.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0007.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0009.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData000a.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData000c.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData000d.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData000f.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0010.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0018.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData001a.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData001b.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData001d.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0020.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0021.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0022.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0024.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0026.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0027.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData002a.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0039.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData003e.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0045.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0046.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0047.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0049.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData004a.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData004b.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData004c.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData004e.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0414.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0416.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0816.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData081a.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsData0c1a.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Nlsdl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NlsLexicons0009.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nltest.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\normaliz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\notepad.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\npmproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nrpsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nshhttp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nshipsec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nshwfp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nsi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nsisvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\nslookup.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntasn1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntdll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntdsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntlanman.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntlanui2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntmarta.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntoskrnl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntprint.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntprint.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntshrui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntvdm64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\objsel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ocsetapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\odbc32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\odbcad32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\odbcbcp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\odbcconf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\odbcconf.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\odbccp32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\odbccr32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\odbccu32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\odbctrac.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OEMLicense.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\offfilt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\offreg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ogldrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ole32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\oleacc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\oleacchooks.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\oleaut32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\oledlg.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\oleprn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OnDemandConnRouteHelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\onex.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\onexui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OobeFldr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OpcServices.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\openfiles.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\opengl32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OpenWith.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OptionalFeatures.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\osbaseln.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\osk.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OskSupport.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\osuninst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\P2P.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\P2PGraph.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\p2pnetsh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\p2psvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\packager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PackageStateRoaming.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\panmap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PasswordOnWakeSettingFlyout.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PATHPING.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pautoenr.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\pcacli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pcadm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pcalua.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pcasvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pcaui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pcaui.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PCPKsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PCPTpm12.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pcsvDevice.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pcwrun.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pcwutl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pdh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pdhui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\perfctrs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\perfdisk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\perfmon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\perfnet.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\perfos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\perfproc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\perftrack.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\perfts.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PhotoMetadataHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PhotoScreensaver.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\photowiz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PickerHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pid.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PING.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PkgMgr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pku2u.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pla.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\plasrv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\playlistfolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PlaySndSrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PlayToDevice.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PlayToManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PlayToStatusProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ploptin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pnidui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pnpclean.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pnppolicy.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\pnpts.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pnpui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PnPUnattend.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PnPutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PNPXAssoc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PNPXAssocPrx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pnrpauto.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Pnrphc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pnrpnsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pnrpsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\polstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\poqexec.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceClassExtension.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceConnectApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceStatus.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceTypes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceWiaCompat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PortableDeviceWMDRM.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pots.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\powercfg.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\powercfg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\powercpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\powrprof.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\prevhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\print.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PrintDialogHost.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\PrintDialogs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\printfilterpipelineprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\printfilterpipelinesvc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PrintIsolationHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PrintIsolationProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\printui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\printui.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\prncache.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\prnfldr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\prnntfy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\prntvpt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\procinst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\profapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\profext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\profprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\profsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\profsvcext.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\propsys.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\proquota.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\provcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\provsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\provthrd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ProximityCommon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ProximityCommonPal.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ProximityRtapiPal.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\ProximityService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ProximityServicePal.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ProximityUxHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\prvdmofcomp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\psapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\psisdecd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\psisrndr.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PSModuleDiscoveryProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\psmsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\psr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pstask.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pstorec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\puiapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\puiobj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PurchaseWindowsLicense.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PurchaseWindowsLicense.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pwlauncher.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pwlauncher.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pwrshplugin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pwsso.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\QAGENT.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\QAGENTRT.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\qasf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\QCLIPROV.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\qdv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\qdvd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\qedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\qmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\qmgrprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\QSHVHOST.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\QSVRMGMT.DLL:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\quartz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Query.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\QUTIL.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\qwave.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RacEngn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\racpldlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\radardt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\radarrs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RADCUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasadhlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasauto.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasautou.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rascfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\raschap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\raschapext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasctrs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rascustom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasdiag.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasdial.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasdlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\raserver.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasgcw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasman.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasmans.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasmbmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RASMM.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasmontr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasmxs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasphone.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasplap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasppp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rastapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rastls.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\rastlsext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdbui.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\rdpcfgex.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdpclip.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdpcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdpcorets.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdpencom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdpendp.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\rdpinput.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RdpSa.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RdpSaProxy.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RdpSaPs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RdpSaUacHelper.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdpudd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdrleakdiag.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RDSAppXHelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdsdwmdr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RDSPnf.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdvidcrl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdvvmtransport.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ReAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ReAgentc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ReAgentTask.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\recimg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\recover.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\recovery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RecoveryDrive.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\reg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\regapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RegCtrl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\regedt32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\regidle.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\regini.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Register-CimProvider.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\regsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\regsvr32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ReInfo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rekeywiz.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\relog.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RelPost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\remotepg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\remotesp.tsp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RemoveDeviceContextHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RemoveDeviceElevated.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\repair-bde.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\replace.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RESAMPLEDMO.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\reseteng.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\resmon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RestoreOptIn.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\resutils.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rfxvmt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rgb9rast.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Ribbons.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\riched20.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\riched32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RMActivate.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RMActivate_isv.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\RMActivate_ssp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RMActivate_ssp_isv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RMapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RmClient.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rmttpmvscmgrsvr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rnr20.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RoamingSecurity.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Robocopy.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RotMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ROUTE.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RpcEpMap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rpchttp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RpcNs4.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rpcnsh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RpcPing.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\rpcrt4.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RpcRtRemote.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rpcss.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rrinstaller.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rsaenh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rshx32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RstrtMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rstrui.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\rtffilt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rtm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rtutils.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RTWorkQ.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\runas.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rundll32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RunLegacyCPLElevated.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\runonce.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RuntimeBroker.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\samcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\samlib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\samsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sas.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sbe.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sbeio.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\scansetting.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SCardDlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SCardSvr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\scavengeui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sccls.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ScDeviceEnum.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\scecli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\scesrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\scext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\schannel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\schedcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\schedsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\schtasks.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\scksp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\scripto.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\scrnsave.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\scrobj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\scrrun.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sdbinst.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sdchange.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sdclt.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sdhcinst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sdiageng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sdiagnhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sdiagprv.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\sdiagschd.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\sdohlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SearchFilterHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SearchFolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SearchIndexer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SearchProtocolHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SecEdit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sechost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\secinit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\seclogon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\secproc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\secproc_isv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\secproc_ssp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\secproc_ssp_isv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\secur32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sendmail.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Sens.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SensApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SensorsApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SensorsClassExtension.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SensorsCpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sensrsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\serialui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\services.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\serwvdrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SessEnv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sessionmsg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\setbcdlocale.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sethc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SetNetworkLocation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SetProxyCredential.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\setspn.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingMonitor.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingSyncCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingSyncHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingSyncPolicy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\setupapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\setupcln.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\setupugc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\setx.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sfc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sfc_os.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shacct.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sharemediacpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SHCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shdocvw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shell32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shfolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shgina.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shimeng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shimgvw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shlwapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shpafact.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shrpubw.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shsetup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shsvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shunimpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shutdown.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shwebsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\signdrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sigverif.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SimAuth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SimCfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sisbkup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SkyDrive.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SkyDriveShell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SkyDriveTelemetry.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SlideToShutDown.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\slpts.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SmartcardCredentialProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SmartCardSimulator.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SmartScreenSettings.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SMBHelperClass.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\smbwmiv2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\smphost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SmsDeviceAccessRevocation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SMSRouter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SndVol.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SndVolSSO.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SnippingTool.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\snmpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\snmptrap.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SNTSearch.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\softkbd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\softpub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sort.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SortServer2003Compat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SortWindows61.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SortWindows6Compat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SoundRecorder.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SpaceAgent.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SpaceControl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spbcd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spfileq.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SPInf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spmpm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spnet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spoolss.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spoolsv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spopk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sppnp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sppobjs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sppsvc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sppwinob.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spwinsat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spwizeng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spwmp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sqlcecompact40.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sqlceoledb40.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sqlceqp40.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sqlcese40.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sqlsrv32.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\sqmapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\srchadmin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\srclient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\srcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SRH.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\srhelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\srrstr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SrTasks.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\srumapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\srumsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\srvcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\srvsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\srwmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sscore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sscoreext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ssdpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ssdpsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sspicli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sspisrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SSShim.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ssText3d.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sstpsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Startupscan.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\stclient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sti.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\StikyNot.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sti_ci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\stobject.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\StorageContextHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\storagewmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\storagewmi_passthru.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\storewuauth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Storprop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\StorSvc.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\streamci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\StructuredQuery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SubscriptionMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\subst.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sud.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\svchost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\svsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\swprv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sxproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sxs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sxshared.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sxssrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sxsstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sxstrace.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SyncCenter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\synceng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SyncEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SyncHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SyncHostps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SyncInfrastructure.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SyncInfrastructureps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Syncreg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\syncui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sysclass.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sysdm.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SysFxUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\syskey.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sysmain.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sysmon.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sysntfy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SysResetErr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\syssetup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\systemcpl.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\SystemEventsBrokerClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemEventsBrokerServer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\systeminfo.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesAdvanced.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesComputerName.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesDataExecutionPrevention.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesHardware.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesPerformance.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesProtection.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemPropertiesRemote.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\systemreset.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemSettings.DeviceEncryptionHandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemSettings.Handlers.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsAdminFlows.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsDatabase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsRemoveDevice.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\systray.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\t2embed.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Tabbtn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TabbtnEx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tabcal.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TabletPC.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TabSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\takeown.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tapi3.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tapilua.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TapiMigPlugin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tapiperf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tapisrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TapiSysprep.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TapiUnattend.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\taskbarcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\taskcomp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\taskeng.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\taskhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\taskhostex.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\taskkill.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tasklist.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Taskmgr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\taskschd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TaskSchdPS.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tbs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tcmsetup.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tcpipcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TcpipSetup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tcpmib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tcpmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tcpmonui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TCPSVCS.EXE:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\tdc.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tdh.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\telephon.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\termmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\termsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TetheringIeProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TetheringMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TetheringStation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\themecpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\themeservice.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\themeui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\threadpoolwinrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\thumbcache.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ThumbnailExtractionHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TimeBrokerClient.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\TimeBrokerServer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\timedate.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TimeDateMUICallback.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\timeout.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TimeSyncTask.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tlscsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tpmcompc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TpmInit.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\TpmTasks.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tpmvsc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tpmvscmgr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tpmvscmgrsvr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tquery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tracerpt.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TRACERT.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\traffic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tree.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\trkwks.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tsbyuv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TSChannel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tsgqec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tsmf.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\TSpkg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TSTheme.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TsUsbGDCoInstaller.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TsUsbRedirectionGroupPolicyExtension.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TSWbPrxy.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\TSWorkspace.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TtlsAuth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TtlsCfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TtlsExt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tvratings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\twext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\twinapi.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\twinapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\twinui.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\twinui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\txflog.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\txfw32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\typeperf.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tzsync.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tzutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ubpm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ucmhc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ucrtbase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\udhisapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\uDWM.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\uexfat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ufat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UI0Detect.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UIAnimation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UIAutomationCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\uicom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\uireng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UIRibbon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UIRibbonRes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ulib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\umb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\umdmxfrm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\umpnpmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\umpo.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\umpoext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\umpowmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\umrdp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\unattend.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\unimdm.tsp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\unimdmat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\uniplat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\unlodctr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\unregmp2.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\untfs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\upnp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\upnpcont.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\upnphost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ureg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\urlmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\usbaaplrc.dll:$CmdTcID [32] AlternateDataStreams: C:\WINDOWS\system32\usbceip.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\usbmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\usbperf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\usbui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\user32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UserAccountBroker.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UserAccountControlSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UserAccountControlSettings.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\usercpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\userenv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\userinit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\userinitext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UserLanguageProfileCallback.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UserLanguagesCpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\usp10.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ustprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UtcResources.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\utildll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Utilman.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\uudf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UXInit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\uxlib.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\uxtheme.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VAN.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Vault.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vaultcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VaultCmd.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VaultRoaming.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\vaultsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VBICodec.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vbisurf.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vbscript.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vds.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vdsbas.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vdsdyn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vdsldr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vdsutil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vdsvd.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\vds_ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\verclsid.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\verifier.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\verifier.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\version.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vfwwdm32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vidcap.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VIDRESZR.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\virtdisk.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\VmApplicationHealthMonitorProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vmbuspipe.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VmdCoinstall.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vmictimeprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vmrdvcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vpnike.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vpnikeapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VscMgrPS.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vssadmin.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vssapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vsstrace.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VSSVC.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vss_ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\w32time.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\w32tm.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\w32topl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WABSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\waitfor.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WallpaperHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WavDest.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wavemsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wbadmin.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wbemcomn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wbengine.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wbiosrvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wcmapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wcmcsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wcmsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WcnApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wcncsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WcnEapAuthProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WcnEapPeerProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WcnNetsh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wcnwiz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WcsPlugInService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wdc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wdi.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\wdiasqmmodule.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wdigest.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wdmaud.drv:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wdscore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WebcamUi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\webcheck.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WebClnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\webio.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\webservices.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Websocket.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wecapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wecsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wecutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wephostsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\werconcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wercplsupport.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WerFault.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WerFaultSecure.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wermgr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wersvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\werui.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\wevtapi.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\wevtfwd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wevtsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wevtutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wfapigp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wfdprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WfHC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WFS.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\where.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\whhelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\whoami.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wiaacmgr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wiaaut.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wiadefui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wiadss.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wiarpc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wiascanprofiles.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wiaservc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wiashext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wiatrace.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WiFiDisplay.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wimgapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wimserv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\win32k.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\win32spl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winbici.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winbio.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winbrand.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wincorlib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wincredprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Background.SystemEventsBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Background.TimeBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Data.Pdf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Background.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Background.ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Custom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Custom.ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Enumeration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Enumeration.ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Geolocation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.PointOfService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Portable.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Printers.Extensions.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Scanners.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Sensors.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.SmartCards.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Usb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.WiFiDirect.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Globalization.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Windows.Globalization.Fontgroups.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Graphics.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Graphics.Printing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\windows.immersiveshell.serviceprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Management.Workplace.WorkplaceSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Devices.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.MediaControl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Renewal.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.SpeechSynthesis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Streaming.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Streaming.ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.ContentPrefetchTask.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.Connectivity.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.HostName.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.NetworkOperators.HotspotAuthentication.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.Proximity.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.Sockets.PushEnabledApplication.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.Vpn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Credentials.UI.CredentialPicker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Credentials.UI.UserConsentVerifier.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Storage.Compression.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.System.Display.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.System.Profile.HardwareId.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.System.Profile.SystemManufacturers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.System.RemoteDesktop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Immersive.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Input.Inking.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Search.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Xaml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Web.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Web.Http.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WindowsAnytimeUpgradeui.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WindowsCodecs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WindowsCodecsExt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\windowslivelogin.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\winethc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinFax.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winhttp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wininet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wininit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wininitext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winipsec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Winlangdb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winload.efi:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winload.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winlogon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winlogonext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winmde.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winmm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winmmbase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinMsoIrmProtector.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winnsi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinOpcIrmProtector.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winresume.efi:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winresume.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winrnr.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\winrs.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winrscmd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winrshost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winrssrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinRtTracing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinSAT.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinSATAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinSCard.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinSetupUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winshfhc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winsku.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winsockhc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winspool.drv:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WINSRPC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winsta.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinSyncMetastore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinSyncProviders.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wintrust.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinTypes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winusb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winver.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wisp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\witnesswmiv2provider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wkscli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wkspbroker.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wkspbrokerAx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wksprt.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wksprtPS.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wkssvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlanapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlancfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WLanConn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlandlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlanext.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\wlangpui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WLanHC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlanhlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlaninst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WlanMM.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlanmsm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlanpref.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WlanRadioManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlansec.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\wlansvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlansvcpal.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlanui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Wldap32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wldp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlgpclnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlidcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlidcredprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlidfdp.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\wlidnsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlidprov.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\wlidsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlrmdr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WlS0WndH.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMADMOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMADMOE.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMALFXGFXDSP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMASF.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmcodecdspps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmdmlog.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmdmps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmdrmdev.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmdrmnet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmdrmsdk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmiclnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmicmiplugin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmidcom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmidx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmiprop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmitomi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMNetMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMPDMC.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WmpDui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmpdxm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmpeffects.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMPhoto.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmpmde.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmpps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmpshell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmsgapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMSPDMOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMSPDMOE.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMVCORE.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMVDECOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmvdspa.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMVENCOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMVSDECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMVSENCD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMVXENCD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WofTasks.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WofUtil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\workerdd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WorkFolders.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WorkfoldersControl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WorkFoldersGPExt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WorkFoldersShell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\workfolderssvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wow64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wow64cpu.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wowreg32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Wpc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpccpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WpcMon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpcsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WpcWebSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpdbusenum.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WpdMtp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WpdMtpUS.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpdshext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WPDShextAutoplay.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WPDShServiceObj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WPDSp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpd_ci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpnapps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpncore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpninprc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpnpinst.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpnprv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpnsruprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\write.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ws2help.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ws2_32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wscapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wscinterop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wscisvif.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSCollect.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wscproxystub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wscript.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wscsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wscui.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSDApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsdchngr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSDMon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSDPrintProxy.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSDScanProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsecedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsepno.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wshbth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wshcon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wshelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wshext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wship6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wshirda.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wshnetbs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wshom.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wshqos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wshrm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSHTCPIP.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WsmAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSManHTTPConfig.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSManMigrationPlugin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WsmAuto.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsmplpxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsmprovhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WsmSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WsmWmiPl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsnmp32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsock32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsqmcons.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSReset.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSShared.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSTPager.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wtsapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wu.upgrade.ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wuapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wuapp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wuauclt.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wuaueng.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\wucltux.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WUDFCoinstaller.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WUDFHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WUDFPlatform.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WUDFSvc.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\WUDFx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WUDFx02000.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wudriver.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wups.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wups2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wusa.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WUSettingsProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wuwebv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WwaApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WWAHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WWanAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wwancfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wwanconn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WWanHC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wwaninst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wwanmm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Wwanpref.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wwanprotdim.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WwanRadioManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wwansvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wwapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XAudio2_8.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xcopy.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XInput1_4.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XInput9_1_0.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\xmlfilter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xmllite.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xmlprovi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xolehlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XpsFilt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XpsGdiConverter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XpsPrint.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XpsRasterService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xpsrchvw.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xpsservices.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XPSSHHDR.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xpssvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xwizard.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xwizards.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xwreg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xwtpdui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xwtpw32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\zipfldr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\accessibilitycpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\acledit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\aclui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\acppage.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\ActionCenter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ActionCenterCPL.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\activeds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\actxprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\adprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\adsldp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\adsldpc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\adsmsext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\adsnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\adtschema.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\advapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\advpack.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\amstream.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\apds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\apphelp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Apphlpdm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\appidapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\apprepapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\apprepsync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\appwiz.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AppxAllUserStore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AppxApplicabilityEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AppxPackaging.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\AppxSip.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ARP.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\aspnet_counters.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\asycfilt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\at.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AtBroker.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\atl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\atlthunk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\atmfd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\atmlib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\attrib.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\audiodev.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioEng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AUDIOKSE.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioSes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\auditpol.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthExt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\authfwcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthFWGP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthFWSnapin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthFWWizFwk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\authui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\authz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\autoconv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\autoplay.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\avicap32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\avifil32.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\avrt.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\azroles.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\azroleui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AzSqlExt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\backgroundTaskHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\BackgroundTransferHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\basecsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\batmeter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bcd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\BCP47Langs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bcrypt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bcryptprimitives.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bdaplgin.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bidispl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\BioCredProv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsadmin.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsperf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx3.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx4.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx5.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bitsprx7.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\biwinrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\blackbox.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\BluetoothApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bootcfg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\browcli.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\browseui.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\bthprops.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bthudtask.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\btpanui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Bubbles.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\BWContextHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ByteCodeGenerator.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cabinet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cabview.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cacls.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\calc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CallButtons.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CallButtons.ProxyStub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CameraSettingsUIHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\capiprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\capisp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\catsrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\catsrvps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\catsrvut.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cca.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cdosys.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\certca.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\certcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\certCredProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\certenc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CertEnroll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CertEnrollCtrl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CertEnrollUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\certmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CertPolEng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\certreq.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\certutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cewmdm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cfgbkend.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cfgmgr32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cfmifs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cfmifsproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\charmap.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\chartv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\chcp.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CheckNetIsolation.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\chkdsk.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\chkntfs.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\choice.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CHxReadingStringIME.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cipher.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\clb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\clbcatq.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cleanmgr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\clfsw32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cliconfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cliconfg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\clip.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudNotifications.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudStorageWizard.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\clusapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmcfg32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmd.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmdext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmdial32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmdkey.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmdl32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmifw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmlua.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmmon32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmpbk32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmstp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmstplua.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmutil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cngcredui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cngprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cnvfat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\colbact.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\COLORCNV.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\colorcpl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\colorui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\combase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\comcat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\comctl32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\comdlg32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\comp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\compact.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CompPkgSup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\compstui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ComputerDefaults.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\comrepl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\comsnap.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\comsvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\comuid.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ConfigureExpandedStorage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\connect.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ConnectedAccountState.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\console.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\control.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\convert.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CPFilters.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CredentialUIBroker.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\credssp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\credui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\credwiz.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\crypt32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptbase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptdlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptdll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptnet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CryptoWinRT.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\crypttpmeksvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptuiwizard.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptxml.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\cscapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cscdll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cscript.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ctfmon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cttune.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cttunesvr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\C_G18030.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\C_IS2022.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\C_ISCII.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d2d1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10core.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10level9.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10warp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10_1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10_1core.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d11.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d8.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d8thk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d9.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_47.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dim.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dim700.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dramp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dxof.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dabapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DafPrintProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DaOtpCredentialProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dataclen.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\davclnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\davhlpr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dbgeng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dbghelp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dbnetlib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dbnmpntw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dccw.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dciman32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dcomcnfg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dcomp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DDACLSys.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ddodiag.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DDOIProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DDORes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ddraw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ddrawex.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DefaultDeviceManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DefaultPrinterProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\delegatorprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\desk.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\deskadp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\deskmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DevDispItemProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\devenum.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\deviceaccess.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\deviceassociation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceCenter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceDisplayStatusManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DevicePairing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DevicePairingFolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DevicePairingProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DevicePairingWizard.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceProperties.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceUxRes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\devmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\devobj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\devrtl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dfrgui.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dfscli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DfsShlEx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcmonitor.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcore6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcsvc6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DHCPQEC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpsapi.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\dialer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\difxapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dimsjob.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dimsroam.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dinput.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dinput8.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\diskcomp.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\diskcopy.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\diskcopy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\diskpart.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\diskperf.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\diskraid.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dispex.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Display.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DisplaySwitch.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dllhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dllhst3g.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dlnashext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmband.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmcompos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmdlgs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmdskmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmime.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmintf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmloader.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmocx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmscript.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmstyle.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmsynth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmusic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmutil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmvdsitf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmview.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dns-sd.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dnsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\docprop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\doskey.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3api.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3cfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3dlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3gpclnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3gpui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3hc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3msm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dot3ui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dpapimig.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dpapiprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DpiScaling.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\driverquery.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\drmmgrtn.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\drmv2clt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\drprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\drt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\drtprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\drttransport.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\drvinst.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\drvstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dsauth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dsdmo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dskquota.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\dskquoui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dsound.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dsparse.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dsprop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dsquery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dsrole.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dssec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dssenh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Dsui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dsuiext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dswave.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dtsh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dui70.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\duser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dvdplay.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dvdupgrd.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dwmapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dwmcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DWrite.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DWWIN.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dxdiag.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dxdiagn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dxgi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dxmasf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DxpTaskSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtmsft.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtrans.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dxva2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\eapp3hst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\eappcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\eappgnui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\eapphost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\eappprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\eapprovp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\EAPQEC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\EaseOfAccessDialog.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\easwrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\efsadu.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\efscore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\efsui.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\efsutil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\efswrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\EhStorAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\EhStorAuthn.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\EhStorPwdMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\els.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ELSCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\elshyph.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\elslad.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\elsTrans.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\encapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\EncDec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\eqossnap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\es.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\esent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\esentprf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\esentutl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\eudcedit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\eventcls.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\eventcreate.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\eventvwr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\evr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\expand.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\explorer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ExplorerFrame.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\extrac32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Faultrep.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fdBth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fdBthProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FdDevQuery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fde.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fdeploy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fdPnp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fdprint.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fdProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fdSSDP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fdWCN.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fdWNet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fdWSD.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\feclient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\filemgmt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\find.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\findnetprinters.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\findstr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\finger.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FirewallAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FirewallControlPanel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fixmapi.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerApp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fltLib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fltMC.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fmifs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fms.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Fondue.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fontext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fontsub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fontview.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\forfiles.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\format.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fphc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\framedyn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\framedynos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\frprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fsutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fsutilext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ftp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fundisc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fwcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FWPUCLNT.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FwRemoteSvr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSAPI.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSCOM.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSCOMEX.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSEXT32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSXP32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\g711codc.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\gameux.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\gcdef.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\gdi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\GdiPlus.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\GEARAspi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\GeofenceMonitorService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\getmac.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\getuname.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\glcndFilter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\glmf32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\GlobCollationHost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\globinputhost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\glu32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\gpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\gpedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\gpprnext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\gpresult.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\gptext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\gpupdate.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\grpconv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hbaapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hcproviders.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hdwwiz.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hdwwiz.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\help.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\HelpPaneProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hgcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hh.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hhctrl.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hhsetup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hid.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hidphone.tsp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hidserv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hlink.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hnetcfg.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\hnetmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\HOSTNAME.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\httpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\htui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ias.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iasacct.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\iasads.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iasdatastore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iashlpr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\IasMigPlugin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iasnap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iaspolcy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iasrad.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iasrecst.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\iassam.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iassdo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iassvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\icacls.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iccvid.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\icm32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\icmui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\IconCodecService.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\icsigd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\icsunattend.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\IdCtrls.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\idndl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\IDStore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ieapfltr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iedkcs32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ieframe.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iepeers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iertutil.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\ieui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ifmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ifsutil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ifsutilx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\imaadp32.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\imagehlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\imapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\imapi2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\imapi2fs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\imm32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcomm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcpl.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\inetmib1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\InfDefaultInstall.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\InkEd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\input.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\InputSwitch.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\instnm.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\intl.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ipconfig.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\IPHLPAPI.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iprop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iprtprio.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iprtrmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ipsecsnp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ipsmsnap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ir32_32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ir41_32.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ir41_qc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ir41_qcx.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\ir50_32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ir50_qc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ir50_qcx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\irclass.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\irprops.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsicli.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsicpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsicpl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsidsc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsied.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsium.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsiwmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsiwmiv2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\isoburn.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\itircl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\itss.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iyuv_32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\joy.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9diag.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\kerberos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\kernel.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\kernel32.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\KernelBase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\keyiso.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\keymgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\kmddsp.tsp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\korwbrkr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ksproxy.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\kstvtune.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ksuser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Kswdmcap.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ksxbar.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ktmutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ktmw32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\l2gpstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\l2nacp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\L2SecHC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\l3codeca.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\l3codecp.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\label.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\LAPRXY.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\LaunchTM.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\linkinfo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\loadperf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\localsec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\LocationApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\LocationNotifications.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\lodctr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\logagent.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\loghours.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\logman.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\logoncli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\lpk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\lsmproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\luainstall.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Magnification.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Magnify.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\main.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\makecab.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mapistub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MbaeApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MbaeApiPublic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mbsmsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mbussdapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mcbuilder.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mciavi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mcicda.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mciqtz32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mciseq.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mciwave.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mdminst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mdmregistration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mf3216.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfAACEnc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfc42.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfc42u.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MFCaptureEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfcsubs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfdvdec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfh264enc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MFMediaEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmjpegdec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfnetcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfnetsrc.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfplat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MFPlay.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfpmp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfreadwrite.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsvr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mftranscode.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfvdsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MFWMAAEC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mgmtapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mibincodec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Microsoft.Management.Infrastructure.Native.Unmanaged.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MicrosoftAccountTokenProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\midimap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\miguiresource.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mimefilt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mimofcodec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MirrorDrvCompat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mispace.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\miutils.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\mlang.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mmc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcbase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mmci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcico.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcndmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcshext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MMDevAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mmsys.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mobsync.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mode.com:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\modemui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\more.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mountvol.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MP3DMOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MP43DECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MP4SDECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Mpeg2Data.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mpg2splt.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MPG4DECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mpr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mprapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mprddm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mprdim.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mprext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mprmsg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MRINFO.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MrmCoreR.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MrmIndexer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msaatext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSAC3ENC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msacm32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msacm32.drv:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msadp32.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msasn1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSAudDecMFT.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msaudite.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mscandui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mscat32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mscms.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mscpxl32.dLL:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\msctf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msctfime.ime:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MsCtfMonitor.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msctfp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msctfui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msctfuimanager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msdadiag.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msdart.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msdelta.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msdmo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msdrm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msdt.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msdtcprx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msdtcuiu.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSDvbNP.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msdxm.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeeds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msftedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msg711.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msgsm32.acm:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MshtmlDac.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtmled.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msidcrl40.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msident.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msidle.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msieftp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msiexec.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msihnd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msiltcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msimg32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msimtf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msinfo32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msisip.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msiwer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mskeyprotcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mskeyprotect.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msls31.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msmpeg2adec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSMPEG2ENC.DLL:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\msmpeg2vdec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msnetobj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSNP.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msoeacct.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msoert2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msorcl32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mspaint.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mspatcha.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mspatchc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msports.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msra.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msrating.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msrdc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MsRdpWebAccess.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msrle32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msscntrs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msscp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msscript.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssha.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msshooks.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssign32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssip32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssitlb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MsSpellCheckingHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssph.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssphtb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssrch.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssvp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mstask.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mstsc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mstscax.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msutb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msv1_0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msvcirt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msvcp60.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msvcrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msvfw32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msvidc32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVidCtl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVideoDSP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msvproc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSWB7.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSWB70011.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSWB7001E.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSWB70404.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSWB70804.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mswmdm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mswsock.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msxml3.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msxml6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msyuv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mtstocom.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxclu.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxdm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxex.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxlegih.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxoci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\muifontsetup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MuiUnattend.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mycomput.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mydocs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Mystify.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\napdsnap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NapiNSP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\napipsec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NAPMONTR.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NAPSTAT.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Narrator.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NaturalLanguage6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NcaApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NcdProp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\nci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ncobjapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ncpa.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ncrypt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ncryptprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ncryptsslp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ndadmin.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\nddeapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ndfapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ndfetw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ndfhcdiscovery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ndiscapCfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ndishc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ndproxystub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\negoexts.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\net.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\net1.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netbios.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\netbtugc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netcenter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netcfgx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netcorehc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netdiagfx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netid.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netiohlp.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\netiougc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netjoin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netlogon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netplwiz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Netplwiz.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netprofm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netprovisionsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netsh.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netshell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NETSTAT.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netutils.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\networkexplorer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\networkitemfactory.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\newdev.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\newdev.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ninput.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NL7Data0011.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NL7Data001E.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NL7Data0404.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NL7Data0804.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\nlaapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\nlhtml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\nlmgp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\nlmproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\nlmsprep.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0000.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0002.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0003.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0007.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0009.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData000a.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData000c.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData000d.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData000f.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0010.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0018.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData001a.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData001b.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData001d.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0020.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0021.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0022.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0024.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0026.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0027.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData002a.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0039.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData003e.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0045.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0046.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0047.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0049.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData004a.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData004b.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData004c.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData004e.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0414.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0416.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0816.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData081a.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0c1a.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Nlsdl.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsLexicons0009.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\normaliz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\notepad.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\npmproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\nshhttp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\nshipsec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\nshwfp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\nsi.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\nslookup.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ntasn1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ntdsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ntlanman.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ntlanui2.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\ntmarta.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ntprint.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ntprint.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ntshrui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ntvdm64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\objsel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ocsetapi.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbc32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcad32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcbcp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcconf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcconf.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbccp32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbccr32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbccu32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcji32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcjt32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbctrac.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\oddbse32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odexl32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odfox32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odpdx32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odtext32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\OEMLicense.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\offfilt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\offreg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ogldrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ole32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\oleacc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\oleacchooks.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\oleaut32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\olecli32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\oledlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\oleprn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\olepro32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\olesvr32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\olethk32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\OnDemandConnRouteHelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\onex.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\onexui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\OobeFldr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\OpcServices.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\openfiles.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\opengl32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\OpenWith.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\osbaseln.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\osk.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\OskSupport.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\osuninst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\P2P.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\P2PGraph.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\p2pnetsh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\packager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PackageStateRoaming.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\panmap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PasswordOnWakeSettingFlyout.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PATHPING.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pautoenr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pcacli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pcaui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pcaui.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PCPKsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PCPTpm12.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pdh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pdhui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\perfctrs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\perfdisk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\perfmon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\perfnet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\perfos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\perfproc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\perfts.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PhotoScreensaver.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\photowiz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PickerHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pid.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PING.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PkgMgr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pku2u.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pla.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\playlistfolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PlaySndSrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToDevice.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToStatusProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pnrpnsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\polstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\poqexec.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceClassExtension.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceConnectApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceStatus.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceTypes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceWiaCompat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PortableDeviceWMDRM.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pots.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\powercfg.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\powercfg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\powercpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\powrprof.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\prevhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\print.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PrintConfig.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PrintDialogs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\printui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\printui.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\prncache.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\prnfldr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\prnntfy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\prntvpt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\profapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\profext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\propsys.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\proquota.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\provcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\provsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\provthrd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ProximityCommon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ProximityCommonPal.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ProximityRtapiPal.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\prvdmofcomp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\psapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\psisdecd.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\psisrndr.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PSModuleDiscoveryProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\psr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pstorec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\puiapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\puiobj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\pwrshplugin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\QAGENT.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\qasf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\QCLIPROV.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\qdv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\qdvd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\qedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\qmgrprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\QSHVHOST.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\QSVRMGMT.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\quartz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Query.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\QUTIL.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\qwave.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RacEngn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\racpldlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\radardt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\radarrs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RADCUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasadhlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasautou.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rascfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\raschap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\raschapext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasctrs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasdiag.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasdial.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasdlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\raserver.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasgcw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasman.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasmontr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasmxs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasphone.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasplap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasppp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rastapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rastls.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\rastlsext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rdpcore.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\rdpencom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rdpendp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RdpSa.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RdpSaProxy.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RdpSaPs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RdpSaUacHelper.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rdrleakdiag.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rdvidcrl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rdvvmtransport.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ReAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ReAgentc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\recover.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\reg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\regapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RegCtrl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\regedit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\regedt32.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\regini.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Register-CimProvider.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\regsvr32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ReInfo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rekeywiz.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\relog.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\remotepg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\remotesp.tsp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RemoveDeviceContextHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RemoveDeviceElevated.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\replace.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RESAMPLEDMO.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\resmon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RestoreOptIn.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\resutils.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rgb9rast.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Ribbons.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\riched20.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\riched32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RMActivate.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\RMActivate_isv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RMActivate_ssp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RMActivate_ssp_isv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RmClient.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rnr20.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Robocopy.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ROUTE.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rpchttp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RpcNs4.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rpcnsh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RpcPing.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rpcrt4.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RpcRtRemote.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rrinstaller.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rsaenh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rshx32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RstrtMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rtffilt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rtm.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\rtutils.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\RTWorkQ.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\runas.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rundll32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RunLegacyCPLElevated.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\runonce.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\samcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\samlib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sas.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sbe.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sbeio.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\scansetting.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SCardDlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\scecli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\scesrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\schannel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\schedcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\schtasks.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\scksp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\scripto.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\scrnsave.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\scrobj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\scrrun.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sdbinst.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sdchange.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sdiageng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sdiagnhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sdiagprv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sdohlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchFilterHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchFolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchIndexer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchProtocolHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SecEdit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sechost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\secinit.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\secproc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\secproc_isv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\secproc_ssp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\secproc_ssp_isv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\secur32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sendmail.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SensApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SensorsApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SensorsCpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\serialui.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\serwvdrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SessEnv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sethc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingMonitor.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSyncCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSyncHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSyncPolicy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\setup16.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\setupapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\setupcln.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\setupugc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\setx.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sfc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sfc_os.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shacct.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SHCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shdocvw.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\shell32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shfolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shgina.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shimeng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shimgvw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shlwapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shpafact.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shrpubw.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shsetup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shsvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shunimpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shutdown.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shwebsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\signdrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SimAuth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SimCfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sisbkup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SkyDriveShell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\slpts.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SmartcardCredentialProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SmartScreenSettings.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SMBHelperClass.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\smphost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SndVol.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SndVolSSO.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\snmpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\softkbd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\softpub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sort.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SortServer2003Compat.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\SortWindows61.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SortWindows6Compat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\spbcd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\spfileq.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SPInf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\spnet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\spopk.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\spp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\spwinsat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\spwizeng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\spwmp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sqlcecompact40.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sqlceoledb40.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sqlceqp40.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sqlcese40.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sqlsrv32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sqmapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\srchadmin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\srclient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SRH.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\srumapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\srumsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\srvcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sscore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ssdpapi.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\sspicli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SSShim.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ssText3d.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Startupscan.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\stclient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sti.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\stobject.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\StorageContextHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\storagewmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\storagewmi_passthru.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Storprop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\StorSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\StructuredQuery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\subst.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sud.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\svchost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sxproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sxs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sxshared.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sxsstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sxstrace.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncCenter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\synceng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncHostps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncInfrastructure.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncInfrastructureps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Syncreg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\syncui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sysdm.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\syskey.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sysmon.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\syssetup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\systemcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemEventsBrokerClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\systeminfo.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesAdvanced.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesComputerName.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesDataExecutionPrevention.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesHardware.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesPerformance.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesProtection.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SystemPropertiesRemote.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\systray.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\t2embed.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\takeown.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tapi3.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TapiMigPlugin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tapiperf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tapisrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TapiSysprep.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TapiUnattend.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\taskcomp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\taskeng.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\taskkill.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tasklist.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Taskmgr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\taskschd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TaskSchdPS.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tbs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tcmsetup.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tcpipcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tcpmib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tcpmonui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TCPSVCS.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tdc.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tdh.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\telephon.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\termmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\themecpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\themeui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\threadpoolwinrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\thumbcache.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ThumbnailExtractionHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TimeBrokerClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\timedate.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TimeDateMUICallback.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\timeout.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tlscsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tpmcompc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TpmInit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tquery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tracerpt.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TRACERT.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\traffic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tree.com:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tsbyuv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TSChannel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tsgqec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tsmf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TSpkg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TSTheme.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TSWorkspace.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TtlsAuth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TtlsCfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TtlsExt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tvratings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\twext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\twinapi.appcore.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\twinapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\txflog.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\txfw32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\typeperf.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tzutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ucmhc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ucrtbase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\udhisapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\uexfat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ufat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UIAnimation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UIAutomationCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\uicom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\uireng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UIRibbon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UIRibbonRes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ulib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\umdmxfrm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\unimdm.tsp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\unimdmat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\uniplat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\unlodctr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\unregmp2.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\untfs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\upnp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\upnpcont.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\upnphost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ureg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\urlmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\usbceip.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\usbperf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\usbui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\user.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\user32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UserAccountBroker.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UserAccountControlSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UserAccountControlSettings.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\usercpl.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\userenv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\userinit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\userinitext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UserLanguageProfileCallback.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\usp10.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ustprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\utildll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Utilman.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\uudf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UXInit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\uxlib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\uxtheme.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\VAN.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Vault.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vaultcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\VBICodec.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vbisurf.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vbscript.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vdmdbg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vds_ps.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\verclsid.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\verifier.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\verifier.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\version.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vfwwdm32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vidcap.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\VIDRESZR.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\virtdisk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vpnikeapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\VscMgrPS.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vssadmin.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vssapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vsstrace.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vss_ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\w32tm.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\w32topl.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\WABSyncProvider.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\waitfor.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wavemsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wbemcomn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wcmapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WcnApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wcnwiz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WcsPlugInService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wdc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wdi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wdigest.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wdmaud.drv:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wdscore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WebcamUi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\webcheck.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WebClnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\webio.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\webservices.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Websocket.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wecapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wecutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFault.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFaultSecure.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wermgr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\werui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wevtapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wevtfwd.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\wevtutil.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wfapigp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wfdprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WfHC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\where.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\whhelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\whoami.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wiaacmgr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wiaaut.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wiadefui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wiadss.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wiascanprofiles.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wiashext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wiatrace.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\wimgapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winbio.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winbrand.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\wincorlib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wincredprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Background.SystemEventsBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Background.TimeBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Background.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Background.ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Custom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Custom.ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Geolocation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.PointOfService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Portable.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Printers.Extensions.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.SmartCards.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.WiFiDirect.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Globalization.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Globalization.Fontgroups.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Graphics.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Management.Workplace.WorkplaceSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Devices.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.MediaControl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.SpeechSynthesis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Streaming.ps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.HostName.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.NetworkOperators.HotspotAuthentication.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.Proximity.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.Sockets.PushEnabledApplication.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Security.Credentials.UI.CredentialPicker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Security.Credentials.UI.UserConsentVerifier.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Storage.Compression.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.System.Display.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.System.Profile.HardwareId.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.System.Profile.SystemManufacturers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.System.RemoteDesktop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Search.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Web.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Web.Http.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WindowsCodecs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WindowsCodecsExt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\windowslivelogin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinFax.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winhttp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wininet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wininitext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winipsec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Winlangdb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winmde.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winmm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winmmbase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinMsoIrmProtector.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winnsi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinOpcIrmProtector.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winrnr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winrs.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winrscmd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winrshost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winrssrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinRtTracing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSATAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSCard.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winshfhc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winsku.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winsockhc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winspool.drv:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WINSRPC.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winsta.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSyncMetastore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSyncProviders.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wintrust.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinTypes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winusb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winver.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wisp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wkscli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wkspbrokerAx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wksprtPS.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlancfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WLanConn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlandlg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanext.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlangpui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanhlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlaninst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WlanMM.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanmsm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanpref.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlansec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Wldap32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlgpclnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlidcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlidcredprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlidfdp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlidnsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlidprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WlS0WndH.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMADMOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMADMOE.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMASF.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmcodecdspps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmdmlog.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmdmps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmdrmdev.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmdrmnet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmdrmsdk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmiclnt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmidcom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmidx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmiprop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmitomi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMNetMgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMPDMC.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WmpDui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpdxm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpeffects.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMPhoto.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpshell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmsgapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMSPDMOD.DLL:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMSPDMOE.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVCORE.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVDECOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmvdspa.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVENCOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVSDECD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVSENCD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVXENCD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wow32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wowreg32.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Wpc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wpcsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wpdshext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WPDShextAutoplay.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WPDShServiceObj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WPDSp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wpnapps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\write.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ws2help.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ws2_32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wscapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wscinterop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wscisvif.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WSClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wscproxystub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wscript.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wscui.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WSDApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wsdchngr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wsecedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wshbth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wshcon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wshelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wshext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wship6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wshirda.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wshom.ocx:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wshqos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wshrm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WSHTCPIP.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WSManHTTPConfig.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WSManMigrationPlugin.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAuto.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wsmplpxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wsmprovhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmWmiPl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wsnmp32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wsock32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WSShared.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WSSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WSTPager.ax:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wtsapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wuapi.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\wuapp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wudriver.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wups.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wusa.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wuwebv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WwaApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WWAHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WWanAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wwapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_8.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xcopy.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XInput1_4.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XInput9_1_0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xmlfilter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xmllite.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xmlprovi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xolehlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XpsFilt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XpsGdiConverter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XpsPrint.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XpsRasterService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xpsrchvw.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xpsservices.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XPSSHHDR.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xpssvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xwizard.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xwizards.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xwreg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xwtpdui.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\xwtpw32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\zipfldr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\acpi.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\afd.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\agilevpn.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ahcache.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\appid.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\bridge.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\bthenum.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\bthhfenum.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\bthpan.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\bthport.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\BTHUSB.SYS:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\btmhsf.sys:Microsoft_Appcompat_ReinstallUpgrade [0] AlternateDataStreams: C:\WINDOWS\system32\Drivers\Classpnp.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\clfs.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\cng.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dfsc.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\disk.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\drmk.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\drmkaud.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dumpfve.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dumpsd.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dxgkrnl.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dxgmms1.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\fltMgr.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\fsdepends.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\fvevol.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidbth.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidclass.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidparse.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidusb.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\http.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\i8042prt.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\IPMIDrv.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\kbdclass.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\kbdhid.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksecdd.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksecpkg.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mouclass.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mouhid.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mountmgr.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mpsdrv.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxdav.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb10.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb20.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mslldp.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mup.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndis.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndiscap.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\NdisImPlatform.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndistapi.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndiswan.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndproxy.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\Ndu.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\netbios.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\netbt.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\netio.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\netvsc63.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\nsiproxy.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ntfs.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\nwifi.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\pacer.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\partmgr.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\portcls.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\qwavedrv.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\rasacd.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\rasl2tp.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\rassstp.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdbss.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdpvideominiport.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\refs.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\rfcomm.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\rmcast.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\rootmdm.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\scfilter.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdbus.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\sermouse.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\spaceport.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\srv.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\srv2.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\srvnet.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ssudbus.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ssudmdm.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\stornvme.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\storport.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\swenum.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\tbs.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\tcpip.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\tdx.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\tpm.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\TsUsbGD.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\tunnel.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\UCX01000.SYS:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\udfs.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\usb8023.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbaapl64.sys:$CmdTcID [32] AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbcir.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbd.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbehci.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbhub.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\USBHUB3.SYS:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbohci.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbport.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\USBSTOR.SYS:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbuhci.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbvideo.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\USBXHCI.SYS:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vhdmp.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmbkmcl.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmbus.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmstorfl.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\volmgr.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\volsnap.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vpci.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\wanarp.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdBoot.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdFilter.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdNisDrv.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\wfplwfs.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\wimmount.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\winhv.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\winusb.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\wpcfltr.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\WUDFPf.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\WUDFRd.sys:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Desktop\6_przedluzenie-sesji-egzaminacyjnej-1.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Desktop\6_przedluzenie-sesji-egzaminacyjnej-1.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Desktop\application.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Desktop\application.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Desktop\boarding-pass(2).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Desktop\boarding-pass(2).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Desktop\cannibale-didier-daeninckx.pdf:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Desktop\cannibale-didier-daeninckx.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Desktop\SKMBT_C45214100810341.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Desktop\SKMBT_C45214100810341.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\001.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\001.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\002.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\002.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\04-Ginter(1).pdf:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\04-Ginter(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\1. Mocarstwo, imperium imperializm.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\1. Mocarstwo, imperium imperializm.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\1.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\1.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\10009642_936524079729608_725420741_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\10009642_936524079729608_725420741_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\10583771_936523746396308_1060479619_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\10583771_936523746396308_1060479619_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\10583771_936523746396308_1060479619_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\10588716_936523889729627_1892768771_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\10588716_936523889729627_1892768771_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\10588716_936523889729627_1892768771_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\10588716_936523889729627_1892768771_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\10621996_1034514843271323_1642334889_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\10621996_1034514843271323_1642334889_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\10647753_936523733062976_1568059220_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\10647753_936523733062976_1568059220_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\10647753_936523733062976_1568059220_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\10647753_936523733062976_1568059220_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\11122465_814138401995976_36205481_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\11122465_814138401995976_36205481_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\11122465_814138401995976_36205481_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\11225575_814138438662639_242018622_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\11225575_814138438662639_242018622_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\11225949_814138451995971_1403847426_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\11225949_814138451995971_1403847426_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\11297772_1034514106604730_776420443_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\11297772_1034514106604730_776420443_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\11351893_868941503143374_1553929801_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\11351893_868941503143374_1553929801_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\11358745_825742560835560_2136185001_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\11358745_825742560835560_2136185001_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\11998086_1034514143271393_403851634_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\11998086_1034514143271393_403851634_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12018705_936523196396363_1978509183_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12018705_936523196396363_1978509183_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12025510_1034515076604633_63602757_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12025510_1034515076604633_63602757_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12047668_1034514663271341_1105703423_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12047668_1034514663271341_1105703423_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12062552_936523419729674_378615808_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12083848_1034514373271370_1804076601_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12083848_1034514373271370_1804076601_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12084187_1034514679938006_1830097355_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12084187_1034514679938006_1830097355_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12084194_1034514126604728_272853747_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12165575_936523489729667_1522466847_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12165575_936523489729667_1522466847_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12192721_936523389729677_90750717_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12192721_936523389729677_90750717_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12192721_936523466396336_1927618609_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12192721_936523466396336_1927618609_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12207661_936524069729609_1626893283_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12207661_936524069729609_1626893283_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12212344_1034514989937975_92282201_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12212344_1034514989937975_92282201_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12226403_1034514776604663_114786809_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12226403_1034514776604663_114786809_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12278264_1034514479938026_799634088_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12278264_1034514479938026_799634088_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12324932_1034513923271415_1837005306_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12324932_1034513923271415_1837005306_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12324932_1034513923271415_1837005306_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12324932_1034513923271415_1837005306_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12325011_1034514279938046_1278246191_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12325011_1034514279938046_1278246191_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12325633_936523106396372_2048117472_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12325633_936523106396372_2048117472_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12349586_936523363063013_351615281_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12349586_936523363063013_351615281_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12404160_953896481314542_87404437_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12404160_953896481314542_87404437_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12404238_953896641314526_1177680240_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12421310_1034513989938075_615594034_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12421940_936523289729687_625732962_o(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12421940_936523289729687_625732962_o(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12421940_936523289729687_625732962_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12421940_936523289729687_625732962_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12421965_936523439729672_1707493551_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12421965_936523439729672_1707493551_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12443281_938477309534285_674358627_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12443281_938477309534285_674358627_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12476397_936524226396260_846802070_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12476397_936524226396260_846802070_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12499080_936523283063021_1663619264_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12499080_936523283063021_1663619264_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12528610_1021278891261585_1063196303_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12528610_1021278891261585_1063196303_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12562690_936523403063009_1336833812_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12562690_936523403063009_1336833812_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12570922_928068330602982_1068344787_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12570922_928068330602982_1068344787_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12576091_936524073062942_1813046602_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12576091_936524073062942_1813046602_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12576254_927751230634692_157612003_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12576254_927751230634692_157612003_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12606743_928068540602961_312524215_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12606743_928068540602961_312524215_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12606955_928068720602943_994155979_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12606955_928068720602943_994155979_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12626080_928068627269619_1413843419_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12626080_928068627269619_1413843419_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12647648_1034514523271355_369560851_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12647648_1034514523271355_369560851_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804069_1034514879937986_1919086854_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804093_936524039729612_163491893_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804093_936524039729612_163491893_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804172_936524009729615_500567958_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804172_936524009729615_500567958_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804172_936524009729615_500567958_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804172_936524009729615_500567958_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804325_936523943062955_1262737608_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804325_936523943062955_1262737608_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804325_936523943062955_1262737608_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804325_936523943062955_1262737608_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804567_936523996396283_1084865343_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804567_936523996396283_1084865343_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804567_936523996396283_1084865343_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12804567_936523996396283_1084865343_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12810113_936523326396350_748787135_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12810113_936523326396350_748787135_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12810329_936523083063041_1272653853_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12810329_936523083063041_1272653853_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822027_936523969729619_324844875_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822027_936523969729619_324844875_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822027_936523969729619_324844875_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822111_936523979729618_1349286052_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822111_936523979729618_1349286052_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822111_936523979729618_1349286052_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822150_1034514179938056_1963861970_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822150_1034514179938056_1963861970_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822186_936523703062979_1432239845_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822186_936523703062979_1432239845_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822186_936523703062979_1432239845_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822186_936523703062979_1432239845_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822257_936523899729626_1030699921_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822257_936523899729626_1030699921_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822257_936523899729626_1030699921_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822257_936523899729626_1030699921_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822631_936523286396354_1757596627_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822749_936523233063026_950073256_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822749_936523233063026_950073256_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822860_936523263063023_1848741692_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822860_936523263063023_1848741692_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822948_936523309729685_1106307063_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12822948_936523309729685_1106307063_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12823154_936523239729692_1838581902_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12823154_936523239729692_1838581902_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12823169_936523356396347_29901063_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12823169_936523356396347_29901063_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825092_936524083062941_2083642941_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825092_936524083062941_2083642941_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825108_936524193062930_1849171585_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825108_936524193062930_1849171585_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825111_936524059729610_1547657572_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825111_936524059729610_1547657572_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825226_936523933062956_1355348281_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825226_936523933062956_1355348281_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825226_936523933062956_1355348281_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825226_936523933062956_1355348281_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825318_936523919729624_523442769_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825318_936523919729624_523442769_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825318_936523919729624_523442769_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825318_936523919729624_523442769_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825410_1034514093271398_691144526_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825410_1034514093271398_691144526_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825424_1034514716604669_1131378996_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825424_1034514716604669_1131378996_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825424_936524033062946_1672291391_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825424_936524033062946_1672291391_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825424_936524033062946_1672291391_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825424_936524033062946_1672291391_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825432_936523723062977_1182047959_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825432_936523723062977_1182047959_n.jpg:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825432_936523723062977_1182047959_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825436_936523983062951_166983998_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825436_936523983062951_166983998_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825436_936523983062951_166983998_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825460_1034514229938051_610909441_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825460_1034514229938051_610909441_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825619_1034514426604698_606841904_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825619_1034514426604698_606841904_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825681_936523766396306_1840611920_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12825681_936523766396306_1840611920_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833198_1034514469938027_1088523548_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833262_1034514266604714_870163648_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833262_1034514266604714_870163648_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833269_936524119729604_2037375185_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833269_936524119729604_2037375185_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833272_1034514066604734_34905842_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833272_1034514066604734_34905842_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833276_1034514003271407_1099427845_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833276_1034514003271407_1099427845_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833360_936524186396264_1663460268_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833360_936524186396264_1663460268_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833427_1034513829938091_358322335_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833427_1034513829938091_358322335_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12833451_938477319534284_2006093882_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834445_1034514833271324_2100788824_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834445_1034514833271324_2100788824_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834489_1034513973271410_914042239_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834489_1034513973271410_914042239_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834496_1034514166604724_1516842978_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834496_1034514166604724_1516842978_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834499_1034514173271390_1064282880_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834499_1034514173271390_1064282880_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834575_936523913062958_1894553144_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834575_936523913062958_1894553144_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834575_936523913062958_1894553144_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834575_936523913062958_1894553144_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834718_936524173062932_272031908_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834718_936524173062932_272031908_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834738_1034515036604637_2041503312_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834738_1034515036604637_2041503312_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834844_936524216396261_44214880_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834844_936524216396261_44214880_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834896_1034514346604706_1952474753_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834896_1034514346604706_1952474753_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834916_1119904658072174_1606292438_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834933_1034514316604709_441674107_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834934_1034514563271351_802143360_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834934_1034514563271351_802143360_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834985_936523783062971_366362307_n(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834985_936523783062971_366362307_n(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834985_936523783062971_366362307_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12834985_936523783062971_366362307_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12835021_1034514693271338_721912280_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12835021_1034514693271338_721912280_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837274_936523336396349_1386735368_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837274_936523336396349_1386735368_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837360_936523299729686_438102263_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837360_936523299729686_438102263_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837388_936523076396375_2111870674_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837388_936523076396375_2111870674_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837389_936523223063027_1528034153_o(1).jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837389_936523223063027_1528034153_o(1).jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837389_936523223063027_1528034153_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837389_936523223063027_1528034153_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837390_936523253063024_36243044_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837390_936523253063024_36243044_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837522_936523176396365_1251185719_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837522_936523176396365_1251185719_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837567_936523189729697_441373391_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837567_936523189729697_441373391_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837719_936523499729666_1133681939_o.jpg:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\12837719_936523499729666_1133681939_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12842470_936523449729671_93536726_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12842470_936523449729671_93536726_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\12884502_1039551186101022_34349466_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\12884502_1039551186101022_34349466_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\13.12.2015-12.03.2016_-_wersja_polska_aktualizacja_pdf.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\13.12.2015-12.03.2016_-_wersja_polska_aktualizacja_pdf.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\1461931_1034514193271388_382270210_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\19-21.06.2015 pl.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\19-21.06.2015 pl.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\2-digital-marketing-glossary.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\2-digital-marketing-glossary.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\2015_05_13_oferta_praktyk_zawodowych_IFR.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\2015_05_13_oferta_praktyk_zawodowych_IFR.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\20160211102535.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\20160211102535.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\2474_fileot.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\2474_fileot.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\27.05.2016-11.06.2016_-_wersja_polska_aktualizacja.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\27.05.2016-11.06.2016_-_wersja_polska_aktualizacja.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\32000x121801.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\32000x121801.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\37811-128666-1-SM.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\37811-128666-1-SM.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\4,5,6,7,8,9,10,11 zagadnienia.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\4,5,6,7,8,9,10,11 zagadnienia.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\621-1060-1-SM(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\621-1060-1-SM(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\621-1060-1-SM.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\621-1060-1-SM.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\702783_1034514639938010_724838425_n.jpg:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\702783_1034514639938010_724838425_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\703006_953896631314527_231960849_n.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\703006_953896631314527_231960849_n.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\7_vocabulaire_fevrier_2015.docx:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\7_vocabulaire_fevrier_2015.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\832-837.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\832-837.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\85x14.mp4:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\85x14.mp4:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\85x14x1.mp4:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\85x14x1.mp4:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\938749_936523346396348_1806358171_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\938749_936523346396348_1806358171_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\938775_936523209729695_519137935_o.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\938775_936523209729695_519137935_o.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\A Textbook of Translation by Peter Newmark (1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\actes_colloque2015.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\ADA601567.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\ADA601567.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\aderex.txt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\aderex.txt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\ADVERBE – définition, formation et fonctions.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\ADVERBE – définition, formation et fonctions.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\ADVERBE.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\ADVERBE.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\alternatywny-przewodnik-dyplomanta-1.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\alternatywny-przewodnik-dyplomanta-1.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Apollinaire-Alcools.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Apollinaire-Alcools.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\article-1(1).doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\article-1(1).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\article-1.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\article-1.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\b617afb5b7348d0a2036a87d8cb3b94b92f72264.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\b617afb5b7348d0a2036a87d8cb3b94b92f72264.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\BBN_NR_20_calosc_nowa(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\BBN_NR_20_calosc_nowa(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\BBN_NR_20_calosc_nowa.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\BBN_NR_20_calosc_nowa.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\bilan_2014_def.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\bilan_2014_def.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\boarding-pass(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\boarding-pass(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\boarding-pass.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\boarding-pass.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Bretagne A-Z.pdf:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\Bretagne A-Z.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Capes-orientations-bibliographiques.docx:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\Capes-orientations-bibliographiques.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\CC L'Allégresse texte(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\CC L'Allégresse texte(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\CC L'Allégresse texte(2).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\CC L'Allégresse texte(2).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\CC L'Allégresse texte.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\CC L'Allégresse texte.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\cd ci ejercicios complementarios.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Cele Zrównoważonego Rozwoju(1).docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Cele Zrównoważonego Rozwoju(1).docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Cele Zrównoważonego Rozwoju.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Cele Zrównoważonego Rozwoju.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Chwalba A - Historia Powszechna. Wiek XIX.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Chwalba A - Historia Powszechna. Wiek XIX.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\CM Freud i Lacan.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\CM Freud i Lacan.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\cm.odt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\cm.odt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Code of Good Subtitling Practice_en.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\comprension de lectura Ana Belen.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\comprension de lectura Ana Belen.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Comprension de lectura b2 videojuegos.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Comprension de lectura b2 videojuegos.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\compresion de lectura cine.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\compresion de lectura cine.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(2).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(2).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(3).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(3).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(4)(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(4)(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(4).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(4).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(5)(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(5)(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(5).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(5).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(6)(1).pdf:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(6)(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation(6).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation2.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\confirmation2.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\contract.pdf:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\contract.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\coup d_État.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\coup d_État.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\CV - Oliwia Ostrowska.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\CV - Oliwia Ostrowska.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\CV - Oliwia.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\CV - Oliwia.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\CV - Oliwia2(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\CV - Oliwia2(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\CV - Oliwia2.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\CV - Oliwia2.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\D19970883Lj.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\D19970883Lj.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\D20020676Lj.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\D20020676Lj.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\D20031268Lj.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\D20031268Lj.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\D20120161Lj.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\D20120161Lj.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\D20130628Lj.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\D20130628Lj.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Daeninckx, Didier - Petit eloge des faits divers.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Daeninckx, Didier - Petit eloge des faits divers.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\DANE DO UMOWY ZLECENIA_DZIEŁO Oliwia Ostrowska.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\DANE DO UMOWY ZLECENIA_DZIEŁO Oliwia Ostrowska.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\DANE DO UMOWY ZLECENIA_DZIEŁO.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\DANE DO UMOWY ZLECENIA_DZIEŁO.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dans le hotspot de Samos, rencontre avec Mehboob [Médecins Sans Frontières].avi:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dans le hotspot de Samos, rencontre avec Mehboob [Médecins Sans Frontières].avi:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\declaration-honour-efc-2014.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\declaration-honour-efc-2014.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\depeche-ems.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\depeche-ems.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dialnet-LaTraductionDesNomsPropresDansDeuxRomansHugoliens-4872562.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dialnet-LaTraductionDesNomsPropresDansDeuxRomansHugoliens-4872562.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dobek część 1.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dobek część 1.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dobek część 2.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dobek część 2.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dok1.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dok1.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Doktryna_Komorowskiego_-_zalozenia.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Doktryna_Komorowskiego_-_zalozenia.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dokument Końcowy Trzeciej Międzynarodowej Konferencji Finansowania Rozwoju.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dokument Końcowy Trzeciej Międzynarodowej Konferencji Finansowania Rozwoju.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dossier stratégique en polonais - Lettre de l_'IRSEM 3-2014.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Dossier stratégique en polonais - Lettre de l_'IRSEM 3-2014.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Drugie Cesarstwo Baszkiewicz.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Drugie Cesarstwo Baszkiewicz.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\dyspozycyjność + grafik - Monopol(1).xlsx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\dyspozycyjność + grafik - Monopol(1).xlsx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\dyspozycyjność + grafik - Monopol.xlsx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\dyspozycyjność + grafik - Monopol.xlsx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\EDT S5 LM 2014-15.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\EDT S5 LM 2014-15.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\EDT S6 LM 2014-15.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\EDT S6 LM 2014-15.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Egzamin Teoria pytania.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Egzamin Teoria pytania.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\eic_25769698.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\eic_25769698.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\ejercicios oraciones condicionales.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\ejercicios oraciones condicionales.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\eksterminacja_ormian.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\eksterminacja_ormian.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\ensaios_michel.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\ensaios_michel.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Europejska_Konwencja_o_Zapobieganiu_Torturom.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Europejska_Konwencja_o_Zapobieganiu_Torturom.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\examen XIX.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\examen XIX.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Feminizm.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Feminizm.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\ff_makieta_praca_licencjacka_1.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Food_for_thought(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Food_for_thought(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Food_for_thought(2).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Food_for_thought(2).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Food_for_thought.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Food_for_thought.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\formularz(2).doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\formularz(2).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Francja_128a_polski_29-11-13_.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Francja_128a_polski_29-11-13_.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Funkcje nazw własnych.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Funkcje nazw własnych.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\FXAC07306PLC_002.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\FXAC07306PLC_002.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\G1213034.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\G1213034.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Gender.Queer.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\geopolitis-unicef-b1-app.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\geopolitis-unicef-b1-app.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\GOJF-Cook.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\GOJF-Cook.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\GRAFIK MONOPOL.xlsx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\GRAFIK MONOPOL.xlsx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\GRAFIK_WGF2016-all(1).xls:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\GRAFIK_WGF2016-all(1).xls:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\GRAFIK_WGF2016-all.xls:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\GRAFIK_WGF2016-all.xls:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Gramatykie.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Gramatykie.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Grammaire.xlsx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Grammaire.xlsx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\harmonogram FINAŁU MOSTY_1.06.2015.xlsx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\harmonogram FINAŁU MOSTY_1.06.2015.xlsx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Haussmann3.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Haussmann3.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\HaussmannDoc.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\HaussmannDoc.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\HIKF-Automatycznie-zapisany.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\HIKF-Automatycznie-zapisany.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\HIKFegzamin.docx:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\HIKFegzamin.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Histoire Contemporaine.odt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Histoire Contemporaine.odt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Historia Francji J.Baszkiewicz.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Historia Francji J.Baszkiewicz.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Hotel Monopol - grafik(1).xlsx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Hotel Monopol - grafik(1).xlsx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Hotel Monopol - grafik.xlsx:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\Hotel Monopol - grafik.xlsx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\House_of_Cards_01x05_Chapter_5.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\House_of_Cards_01x05_Chapter_5.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\ibe-raport-polityka-jezykowa-w-europie.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\ibe-raport-polityka-jezykowa-w-europie.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Idomeni (Grèce)_ désespoir et maladies s'emparent des migrants bloqués.avi:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Idomeni (Grèce)_ désespoir et maladies s'emparent des migrants bloqués.avi:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\IMG-20160505-WA0030.jpg:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\IMG-20160505-WA0030.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\IMG_7525.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\IMG_7525.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\index.djvu:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\index.djvu:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Intouchable.2011.1080p.BluRay.x264.ReEnc-Max.srt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Intouchables 2011.srt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Intouchables 2011.srt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Intouchables-Untouchable-FR.txt:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\Intouchables-Untouchable-FR.txt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Intouchables.2011.FRENCH.720p.BluRay.x264.www.subsynchro.com.srt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Intouchables.2011.FRENCH.720p.BluRay.x264.www.subsynchro.com.srt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\iTunes64Setup.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\iTunes64Setup.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\JCR.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\JCR.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Karta Polaka.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Karta Polaka.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\karta_pracy_dyplomowej.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Komunikowanie polityczne cw.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Komunikowanie polityczne cw.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Komunikowanie polityczne kolokwium.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Konwencja_o_Ochronie_Praw_Czlowieka_i_Podstawowych_Wolnosci.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\KROKI.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\KROKI.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\L.Intouchable.2006.RIP.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\L.Intouchable.2006.RIP.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\la these de licence.odt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\la these de licence.odt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\le realisme dans l'art.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\le realisme dans l'art.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Le reportage de la Rédaction.mp3:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\Le reportage de la Rédaction.mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Le reveil des classes pauvres.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Le reveil des classes pauvres.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Le réalisme dans l_art.ppt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Le réalisme dans l_art.ppt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Le-siège-de-Paris-et-la-vie-dans-la-capitale-assiégée.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Le-siège-de-Paris-et-la-vie-dans-la-capitale-assiégée.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning agreement(1)(1).doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning agreement(1)(1).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning agreement(1).doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning agreement(1).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning agreement.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning_agreement_changes_Oliwia_Ostrowska(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning_agreement_changes_Oliwia_Ostrowska(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning_agreement_changes_Oliwia_Ostrowska(2).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning_agreement_changes_Oliwia_Ostrowska(2).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning_agreement_changes_Oliwia_Ostrowska.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning_agreement_Karolina_Buka(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning_agreement_Karolina_Buka(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning_agreement_Karolina_Buka.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning_agreement_Oliwia_Ostrowska.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\learning_agreement_Oliwia_Ostrowska.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Les grands magasins 2.(1).pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Les grands magasins 2.(1).pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\LGC-CM.odt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\LGC-CM.odt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Lic_LETTRES_MODERNES.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\lista.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Literatura francuska tomicka.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Literatura francuska tomicka.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Miedzynarodowy_Pakt_Praw_Obywatelskich_i_Politycznych.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Miedzynarodowy_Pakt_Praw_Obywatelskich_i_Politycznych.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\mieżejewski.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\mieżejewski.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\molier cz analityczna.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\molier cz analityczna.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Monopol dla wolontariuszy 1.06.2016.xlsx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Monopol dla wolontariuszy 1.06.2016.xlsx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\MOSTY DLA LIDERÓW - gotowe.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\MOSTY DLA LIDERÓW - gotowe.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\N1362707(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\N1362707(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Nagłośnienie kwestii wyborów do Parlamentu Europejskiego przez RZ.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Nagłośnienie kwestii wyborów do Parlamentu Europejskiego przez RZ.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\newmagasin.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\newmagasin.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\newsletter 2_WGF2016.compressed.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\newsletter 2_WGF2016.compressed.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\newsletter_WGF2016.compressed.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\newsletter_WGF2016.compressed.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\notables - crise du milieu du siecle.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\notables - crise du milieu du siecle.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Notatki(1).rar:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Notatki(1).rar:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Notatki(2).rar:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Notatki(2).rar:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Notatki(3).rar:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Notatki(3).rar:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Notatki.rar:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Notatki.rar:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Nowe inicjatywy 2.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Nowe inicjatywy 2.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\O19_Faktura_indywidualna_000-038-3523-8656_16_08_F002_AA.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\O19_Faktura_indywidualna_000-038-3523-8656_16_08_F002_AA.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Obraz.JPG:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Obraz.JPG:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Obraz0007.JPG:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Obraz0007.JPG:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Oceny-erasmus.odt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Oceny-erasmus.odt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Oliwia Ostrowska cv.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Oliwia Ostrowska cv.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Oliwia Ostrowska.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Oliwia Ostrowska.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\OPC-UW-std.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\OPC-UW-std.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\osa5042843905536064756.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\osa5042843905536064756.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Oswiadczenie_majatkowe_2013_rok_Walery_Czarnecki.pdf:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\Oswiadczenie_majatkowe_2013_rok_Walery_Czarnecki.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\oświadczenie-1.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\oświadczenie-1.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\oświadczenie-2.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\oświadczenie-2.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Persavon-karta-informacyjna_Sandra-Nożewska.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Persavon-karta-informacyjna_Sandra-Nożewska.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\placed_order_507831_20160619.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\placed_order_507831_20160619.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Podanie studenta o warunek 2013_2.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Podanie studenta o warunek 2013_2.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Podanie-zima.odt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Podanie-zima.odt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\podanie.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\podanie.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\POEZJA(1).docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\POEZJA(1).docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\POEZJA.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\POEZJA.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\polityka jzykowa europy.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\polityka jzykowa europy.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Polska polityka zagraniczna po wyborach. Moliwe scenariusze.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Polska polityka zagraniczna po wyborach. Moliwe scenariusze.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Polska.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Polska.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Postkolonializm-CM.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Postkolonializm-CM.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Postkolonializm.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Postkolonializm.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Postkolonializm.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Postkolonializm.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Poststrukturalizm.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Powszechna_Deklaracja_Praw_Czlowieka.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Powszechna_Deklaracja_Praw_Czlowieka.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Praca licencjacka(1).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Praca licencjacka.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Praca licencjacka.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Praca magisterska.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Praca magisterska.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\praca-gojf(1).doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\praca-gojf(1).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\praca-gojf.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\President_Allocution_ouverture_colloque_26janv15.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\President_Allocution_ouverture_colloque_26janv15.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Prezentacja - Le symbolisme.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Prezentacja - Le symbolisme.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Prezentacja1.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Prezentacja1.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Program_WGF2016.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Program_WGF2016.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\projekt pracy licencjackiej Małgorzata Ślęzak(1).docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\projekt pracy licencjackiej Małgorzata Ślęzak.docx:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\projekt pracy licencjackiej Małgorzata Ślęzak.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Protokol_nr_13_do_KwSLWFDK.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Protokol_nr_13_do_KwSLWFDK.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Protokol_nr_6_do_KwSLWFDK.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Protokol_nr_6_do_KwSLWFDK.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Przedmioty-Erasmus.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Przedmioty-Erasmus.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Przekladaniec-20-2.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Przekladaniec-20-2.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\przelew(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\przelew(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\przelew(2).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\przelew(2).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\przelew.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\przelew.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\przewodnik-po-apd-1.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\przewodnik-po-apd-1.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\przypisy.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\przypisy.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\pseudorecenzja-pseudorecenzji.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\pseudorecenzja-pseudorecenzji.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\pub_cles_session_2015.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\pub_cles_session_2015.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\putty_ssh(1).exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\putty_ssh(1).exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\putty_ssh.exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\putty_ssh.exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\rapport-parl-2014_en-ligne.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\rapport-parl-2014_en-ligne.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\rapport_web13.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\rapport_web13.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\realisme.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\realisme.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\realizm.rtf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\realizm.rtf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Referat-ludobójstwo.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Referat-ludobójstwo.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\resume.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\resume.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\revue de presse RFI .mp3:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\revue de presse RFI .mp3:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Rysunek_w_psychoterapii(1).doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Rysunek_w_psychoterapii(1).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan.pdf:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan10009.JPG:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan10009.JPG:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan391(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan391(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan391.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan391.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan392(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan392(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan392.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Scan392.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\seminarium licencjackie 2015 16 zima program.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\seminarium licencjackie 2015 16 zima program.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\setup.zip:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\setup.zip:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\shylock.txt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\shylock.txt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Silverlight_x64(1).exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Silverlight_x64(1).exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Silverlight_x64(2).exe:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Silverlight_x64(2).exe:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\slownik_idiomatyczny_francusko_polski-universitas-demo.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\slownik_idiomatyczny_francusko_polski-universitas-demo.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\smime.p7s:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\smime.p7s:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\So-You-think.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\So-You-think.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Socjokrytyka.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Socjokrytyka.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\st.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\stomatologiczna_pomoc_dorazna_2015_r..xlsx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\stomatologiczna_pomoc_dorazna_2015_r..xlsx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Strategiczne_partnerstwo_Unii_Europejskiej_i_Rosji_w_polityce_bezpieczenstwa_-_szanse__przeszkody_i_stan_obecny.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Strategiczne_partnerstwo_Unii_Europejskiej_i_Rosji_w_polityce_bezpieczenstwa_-_szanse__przeszkody_i_stan_obecny.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Strukturalizm 1.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Strukturalizm 1.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Strukturalizm 2.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Strukturalizm 2.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\str__91-109_Aleksandra_Szuszczykiewicz.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\str__91-109_Aleksandra_Szuszczykiewicz.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\styleguide_polish_dgt_pl.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\styleguide_polish_dgt_pl.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\SYMBOLISME.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\SYMBOLISME.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Tabele(1).docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Tabele(1).docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Tabele.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Tabele.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\TD contemporaine.odt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\TD contemporaine.odt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Techniki-przekładu.pptx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Techniki-przekładu.pptx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Tekst numer 1(1).docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Tekst numer 1(1).docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Tekst numer 2(1).docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Tekst numer 2(1).docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\The Intouchables 2011 720p BluRay x264 French AAC - Ozlem.txt:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\The Intouchables 2011 720p BluRay x264 French AAC - Ozlem.txt:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\these.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\these.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\transcription d'art d'art .doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\transcription d'art d'art .doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Trzecia Międzynarodowa Konferencja Finansowania Rozwoju.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Trzecia Międzynarodowa Konferencja Finansowania Rozwoju.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Uchwała Nr 94_2014 Senatu UWr z dnia 24.09.2014 r. w sprawie zasad pobierania opłat za świadczone usługi edukacyjne oraz trybu i warunków zwalniania z tych oplat.pdf:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\Uchwała Nr 94_2014 Senatu UWr z dnia 24.09.2014 r. w sprawie zasad pobierania opłat za świadczone usługi edukacyjne oraz trybu i warunków zwalniania z tych oplat.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\umowa-zlecenia-wzor-nr-1.gofin:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\umowa-zlecenia-wzor-nr-1.gofin:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\un ano en paris texto.jpg:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\un ano en paris texto.jpg:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\UWr-21-238404-2016 (watermarked).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\UWr-21-238404-2016.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\UWr-21-238404-2016.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\V-TONEATTO_CV_publications.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\V-TONEATTO_CV_publications.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\video-1458482143.mp4:$CmdTcID [130] AlternateDataStreams: C:\Users\Oliwia\Downloads\video-1458482143.mp4:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Video.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Video.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\votrelangue-sentiments-prof.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\votrelangue-sentiments-prof.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Wawel slownik tlumaczonego tekstu -(1).docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Wawel slownik tlumaczonego tekstu -(1).docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Wawel slownik tlumaczonego tekstu -.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Wawel slownik tlumaczonego tekstu -.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF 2016 Volunteers Application Form.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF 2016 Volunteers Application Form.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF-2016-VOLUNTEERS-APPLICATION-FORM 1.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF-2016-VOLUNTEERS-APPLICATION-FORM 1.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF-2016-VOLUNTEERS-APPLICATION-FORM.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF-2016-VOLUNTEERS-APPLICATION-FORM.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF2016 - Hotel Monopol(1).xls:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF2016 - Hotel Monopol(1).xls:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF2016 - Hotel Monopol.xls:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF2016 - Hotel Monopol.xls:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF2016-test_odpowiedzi PL(1).pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF2016-test_odpowiedzi PL(1).pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF2016-test_odpowiedzi PL.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\WGF2016-test_odpowiedzi PL.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\wniosek o zwolnienie z opłat za powtarzanie przedmiotów.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\wniosek o zwolnienie z opłat za powtarzanie przedmiotów.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\wyciag_z_transcript_of_records_pl.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\wyciag_z_transcript_of_records_pl.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Wyklady.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Wyklady.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Wykład wstępny.pdf:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Wykład wstępny.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Wypełniona-karta-informacyjna.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Yann Quéffélec - Les noces barbares.mobi:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Yann Quéffélec - Les noces barbares.mobi:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\zadanie - wypowiedź znanej osoby_Sandra Nożewska.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\zadanie - wypowiedź znanej osoby_Sandra Nożewska.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\zagadnienia do egzaminu.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\zagadnienia do egzaminu.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\zagadnienia do sprawdzianu2.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\zagadnienia do sprawdzianu2.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\zal_10_form_aplikacyjny_wolontariat(2).doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\zal_10_form_aplikacyjny_wolontariat(2).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\zal_10_form_aplikacyjny_wolontariat(3).doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\zal_10_form_aplikacyjny_wolontariat(3).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\zal_2_oswiadczenie_o_niekaralnosci(2).doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\zal_2_oswiadczenie_o_niekaralnosci(2).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\zal_2_oswiadczenie_o_niekaralnosci(3).doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\zal_2_oswiadczenie_o_niekaralnosci(3).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\zal_5_form_aplikacyjny_praktyka_studencka(3).doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\zal_5_form_aplikacyjny_praktyka_studencka(3).doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Zaświadczenie ONZ.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\zaświadczenie.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\zaświadczenie.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\Zeszyt1.xlsx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\Zeszyt1.xlsx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\ZGODA RODZICÓW NA UDZIAŁ W WOLONTARIACIE PODCZAS WGF2016.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\ZGODA RODZICÓW NA UDZIAŁ W WOLONTARIACIE PODCZAS WGF2016.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\zgłoszenie_obrony_indywidualne.doc:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\zgłoszenie_obrony_indywidualne.doc:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\ZRÓWNOWAŻONE CELE ROZOWOJU.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\ZRÓWNOWAŻONE CELE ROZOWOJU.docx:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\~WRL0001.tmp:$CmdZnID [26] AlternateDataStreams: C:\Users\Oliwia\Downloads\~WRL4048.tmp:$CmdTcID [64] AlternateDataStreams: C:\Users\Oliwia\Downloads\~WRL4048.tmp:$CmdZnID [26] ==================== Tryb awaryjny (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Wartość "AlternateShell" zostanie przywrócona.) ==================== Powiązania plików (filtrowane) =============== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci.) ==================== Internet Explorer - Witryny zaufane i z ograniczeniami =============== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru.) ==================== Hosts - zawartość: =============================== (Użycie dyrektywy Hosts: w fixlist spowoduje reset pliku Hosts.) 2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Inne obszary ============================ (Obecnie brak automatycznej naprawy dla tej sekcji.) HKU\S-1-5-21-2577532048-60505754-3398219096-1001\Control Panel\Desktop\\Wallpaper -> HKU\S-1-5-21-2577532048-60505754-3398219096-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Oliwia\AppData\Roaming\Microsoft\Windows Photo Viewer\Tapeta z Przeglądarki fotografii systemu Windows.jpg DNS Servers: 192.168.1.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Zapora systemu Windows [funkcja włączona] ==================== MSCONFIG/TASK MANAGER - Wyłączone elementy == ==================== Reguły Zapory systemu Windows (filtrowane) =============== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{E95D89AD-9989-4C05-ACAF-898C121494DC}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe FirewallRules: [{12DF1A07-B3AA-4A8E-B07A-FFEB96E3D57E}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe FirewallRules: [{5CFB48C5-F9CE-484F-89C0-6C605795E995}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe FirewallRules: [{E8DADA6F-1EBE-4F43-9966-26640E6A0B9F}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe FirewallRules: [{32FCA6B8-6FA3-4EF6-94ED-8AEDFAEC5004}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe FirewallRules: [{1C3D758D-EB92-4660-BE4C-633570199517}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe FirewallRules: [{9D1FDD01-5688-49BD-9127-C1B7F2FCD4DD}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe FirewallRules: [{CD1174EE-FE6B-4FC6-B54A-EA739E8CC5C8}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe FirewallRules: [{6575055F-BC29-4E78-908F-2891B3B1F5E3}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe FirewallRules: [{E05A4EEE-9EA9-4996-9E71-92B9C0E8EC6C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe FirewallRules: [{E655654B-50F3-40E7-9823-67D062B610FC}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe FirewallRules: [{CBC14AE4-06F3-49F9-988B-48476BBB564F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{7520BD90-5F3D-44AF-97B7-64288124F85B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{8DF00DC2-471E-40C7-950F-3E4080BAF1BE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{1E43051F-044B-4877-98A3-DD54F258714D}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{7DD45508-8784-4C10-AABA-FBBF17718E0E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{BF9525F4-15DC-4E20-92D3-9F2BE20DF1BC}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [TCP Query User{BAA29460-9E73-48E0-93FC-C77977E9C8AE}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [UDP Query User{F4F9833E-DF69-47B1-9919-B9FA9F8C89C1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [{B5F348A0-E400-4367-A7EB-857FDFD5EED6}] => (Allow) C:\Program Files (x86)\NapiProjekt\napisy.exe FirewallRules: [{1CAD6F46-79E6-4153-91D2-B757E3A5F993}] => (Allow) C:\Program Files (x86)\NapiProjekt\napisy.exe FirewallRules: [{5FA5D7D6-C74A-4ECC-B862-9C949E73609B}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{F2D21BA2-318A-404C-B563-169282BC616B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{A4503526-90F4-4236-AEFC-C3F347033FCD}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Punkty Przywracania systemu ========================= ==================== Wadliwe urządzenia w Menedżerze urządzeń ============= ==================== Błędy w Dzienniku zdarzeń: ========================= Dziennik Aplikacja: ================== Error: (10/02/2016 03:37:58 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nazwa aplikacji powodującej błąd: vlc.exe, wersja: 2.1.5.0, sygnatura czasowa: 0x00000000 Nazwa modułu powodującego błąd: ntdll.dll, wersja: 6.3.9600.18438, sygnatura czasowa: 0x57ae642e Kod wyjątku: 0xc0000005 Przesunięcie błędu: 0x00000000000546fb Identyfikator procesu powodującego błąd: 0x484 Godzina uruchomienia aplikacji powodującej błąd: 0x01d21ca890d1c838 Ścieżka aplikacji powodującej błąd: C:\Program Files\VideoLAN\VLC\vlc.exe Ścieżka modułu powodującego błąd: C:\WINDOWS\SYSTEM32\ntdll.dll Identyfikator raportu: 6d8a7ef9-88a5-11e6-bf33-74d02b161241 Pełna nazwa pakietu powodującego błąd: Identyfikator aplikacji względem pakietu powodującego błąd: Error: (10/02/2016 02:32:39 PM) (Source: DptfEvent) (EventID: 2) (User: ) Description: DptfPolicyLpmServiceHelper WinMain: CreateSharedMemory() failed. Session ID = 4 Error: (10/02/2016 02:32:39 PM) (Source: DptfEvent) (EventID: 3) (User: ) Description: DptfPolicyLpmServiceHelper CreateSharedMemory: WaitForSingleObject() with g_pkeLpmSharedMemoryCreated failed Last error = [0x00000102] Session ID = 4 Error: (10/02/2016 02:26:56 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 70266297 Error: (10/02/2016 02:26:56 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 70266297 Error: (10/02/2016 02:26:56 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (10/01/2016 06:37:45 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nazwa aplikacji powodującej błąd: vlc.exe, wersja: 2.1.5.0, sygnatura czasowa: 0x00000000 Nazwa modułu powodującego błąd: ntdll.dll, wersja: 6.3.9600.18438, sygnatura czasowa: 0x57ae642e Kod wyjątku: 0xc0000005 Przesunięcie błędu: 0x00000000000546fb Identyfikator procesu powodującego błąd: 0x8b0 Godzina uruchomienia aplikacji powodującej błąd: 0x01d21bffbbce5765 Ścieżka aplikacji powodującej błąd: C:\Program Files\VideoLAN\VLC\vlc.exe Ścieżka modułu powodującego błąd: C:\WINDOWS\SYSTEM32\ntdll.dll Identyfikator raportu: 60cae824-87f5-11e6-bf33-74d02b161241 Pełna nazwa pakietu powodującego błąd: Identyfikator aplikacji względem pakietu powodującego błąd: Error: (10/01/2016 06:19:22 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nazwa aplikacji powodującej błąd: vlc.exe, wersja: 2.1.5.0, sygnatura czasowa: 0x00000000 Nazwa modułu powodującego błąd: ntdll.dll, wersja: 6.3.9600.18438, sygnatura czasowa: 0x57ae642e Kod wyjątku: 0xc0000005 Przesunięcie błędu: 0x00000000000546fb Identyfikator procesu powodującego błąd: 0x1be0 Godzina uruchomienia aplikacji powodującej błąd: 0x01d21bff5f77cf6b Ścieżka aplikacji powodującej błąd: C:\Program Files\VideoLAN\VLC\vlc.exe Ścieżka modułu powodującego błąd: C:\WINDOWS\SYSTEM32\ntdll.dll Identyfikator raportu: cf841abe-87f2-11e6-bf33-74d02b161241 Pełna nazwa pakietu powodującego błąd: Identyfikator aplikacji względem pakietu powodującego błąd: Error: (10/01/2016 06:17:55 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nazwa aplikacji powodującej błąd: vlc.exe, wersja: 2.1.5.0, sygnatura czasowa: 0x00000000 Nazwa modułu powodującego błąd: ntdll.dll, wersja: 6.3.9600.18438, sygnatura czasowa: 0x57ae642e Kod wyjątku: 0xc0000005 Przesunięcie błędu: 0x00000000000546fb Identyfikator procesu powodującego błąd: 0xd4 Godzina uruchomienia aplikacji powodującej błąd: 0x01d21bff401bbdc3 Ścieżka aplikacji powodującej błąd: C:\Program Files\VideoLAN\VLC\vlc.exe Ścieżka modułu powodującego błąd: C:\WINDOWS\SYSTEM32\ntdll.dll Identyfikator raportu: 9b67907b-87f2-11e6-bf33-74d02b161241 Pełna nazwa pakietu powodującego błąd: Identyfikator aplikacji względem pakietu powodującego błąd: Error: (10/01/2016 04:10:11 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: ) Description: Z powodu wystąpienia problemu dane Programu poprawy jakości obsługi klienta nie zostały wysłane do firmy Microsoft. (Błąd 80070005). Dziennik System: ============= Error: (10/02/2016 02:55:57 PM) (Source: disk) (EventID: 11) (User: ) Description: Sterownik wykrył błąd kontrolera na \Device\Harddisk1\DR3. Error: (10/01/2016 06:55:45 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP) Description: Serwer {4545DEA0-2DFC-4906-A728-6D986BA399A9} nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (10/01/2016 06:55:45 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP) Description: Serwer {4545DEA0-2DFC-4906-A728-6D986BA399A9} nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (09/29/2016 06:41:01 PM) (Source: volsnap) (EventID: 36) (User: ) Description: Wykonywanie kopii w tle woluminu C: zostało przerwane, ponieważ nie można powiększyć magazynu kopii w tle z powodu limitu wprowadzonego przez użytkownika. Error: (09/28/2016 09:18:41 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP) Description: Serwer {4545DEA0-2DFC-4906-A728-6D986BA399A9} nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (09/28/2016 09:18:41 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP) Description: Serwer {4545DEA0-2DFC-4906-A728-6D986BA399A9} nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (09/28/2016 06:30:21 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP) Description: Serwer Microsoft.Reader.AppXqwpk1t4bvqdvwhxhbyg53psw2e2hmdrd.mca nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (09/27/2016 10:41:15 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP) Description: Serwer {4545DEA0-2DFC-4906-A728-6D986BA399A9} nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (09/27/2016 10:41:15 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP) Description: Serwer {4545DEA0-2DFC-4906-A728-6D986BA399A9} nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (09/27/2016 08:13:05 PM) (Source: disk) (EventID: 7) (User: ) Description: W urządzeniu \Device\Harddisk0\DR0 wystąpił zły blok. CodeIntegrity: =================================== Date: 2016-10-02 16:16:44.316 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-02 14:28:01.699 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-01 18:16:44.978 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-01 17:46:24.370 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-01 17:34:18.400 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-01 17:13:35.009 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-01 16:47:17.598 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-10-01 15:48:58.449 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-09-30 17:19:50.883 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2016-09-29 21:21:32.591 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. ==================== Statystyki pamięci =========================== Procesor: Intel(R) Core(TM) i3-3217U CPU @ 1.80GHz Procent pamięci w użyciu: 56% Całkowita pamięć fizyczna: 3981.68 MB Dostępna pamięć fizyczna: 1745.81 MB Całkowita pamięć wirtualna: 4685.68 MB Dostępna pamięć wirtualna: 1932.63 MB ==================== Dyski ================================ Drive c: (OS) (Fixed) (Total:100.08 GB) (Free:0.27 GB) NTFS ==>[dysk z komponentami startowymi (pozyskano odczytując BCD)] Drive d: (DATA) (Fixed) (Total:365.68 GB) (Free:317.14 GB) NTFS ==================== MBR & Tablica partycji ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 6A9158E2) Partition 1: (Active) - (Size=100.1 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=365.7 GB) - (Type=07 NTFS) ==================== Koniec Addition.txt ============================