С компьютера не пингуется ничего (в т.ч. 127.0.0.1)
Здравствуйте,
Столкнулся с проблемой, что с компьютера не пингуется ничего, соответственно и интернета нет. При этом в сети пинги на него проходят. Попробовал выполнить все по шагам по ссылке (http://tech-grounds.com/unidentifiednetworksolution), не помогло
Логи собрал, приаттачил к посту. Пожалуйста, помогите разобраться.
Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:
Уважаемый(ая) Egor Kromberg, спасибо за обращение на наш форум!
Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи.
Информация
Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.
Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.
Началось не после установки COMODO Internet Security Premium? Если да - удалите.
WBR,
Vadim
Спасибо. Похоже, что еще и после обновления Windows. COMODO Internet Security Premium я пользуюсь уже достаточно давно, недавно обновления устанавливал на него, он как-то криво встал похоже. Я его пытался удалить, все равно что-то вылезает при загрузке. Попытаюсь еще раз его снести полностью. Думаете, что проблема в нем (тоже на него сначала грешил)? В логах ничего странного не обнаружено?Сообщение от Vvvyg
По крайней мере, с вирусами проблема точно не связана, Comodo или системный сбой. Точки восстановления системы, созданные до возникновения проблемы есть?
WBR,
Vadim
Да, восстановился недавно, но все равно проблема не исчезла. Можете посоветовать куда копать?
Для начала удалите Comodo.
Запустите cmd.exe через правую кнопку мыши Запуск от имени администратора) и выполните следующие команды:Если не поможет - делайте такой лог.Код:netsh winsock reset all netsh int 6to4 reset all netsh int ipv4 reset all netsh int ipv6 reset all netsh int httpstunnel reset all netsh int isatap reset all netsh int portproxy reset all netsh int tcp reset all netsh int teredo reset all
Скачайте Farbar Recovery Scan Tool и сохраните на Рабочем столе.
Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.
Запустите программу. Когда программа запустится, нажмите Yes для соглашения с предупреждением.
Нажмите кнопку Scan.
После окончания сканирования будут созданы отчеты FRST.txt, Addition.txt в той же папке, откуда была запущена программа.
Прикрепите эти файлы к своему следующему сообщению (можно все в одном архиве).
Последний раз редактировалось Vvvyg; 17.04.2017 в 23:15.
WBR,
Vadim
Спасибо.
Сброс winsock и интерфейсов не помог. Могу сказать, что интернет работает в безопасном режиме. Пробовал выключать все из автозагрузки - тоже не работает.
Farbar tool прогнел, логи приаттачил.
Последний раз редактировалось Egor Kromberg; 17.04.2017 в 23:52.
В безопасном режиме сделайте следующее.
Откройте Блокнот (Старт =>Программы => Стандартные => Блокнот). Скопируйте в него следующий код:и сохраните как fixlist.txt в папку с Farbar Recovery Scan Tool.Код:CreateRestorePoint: HKU\S-1-5-21-87087875-2551032368-3624025436-1001\...\Run: [GoogleChromeAutoLaunch_74A9289A10AEEDA7CC18E8031CC2549A] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1111896 2017-03-29] (Google Inc.) GroupPolicy: Restriction <======= ATTENTION CHR HKU\S-1-5-21-87087875-2551032368-3624025436-1001\SOFTWARE\Policies\Google: Restriction <======= ATTENTION Winsock: Catalog5-x64 07 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File Winsock: Catalog5-x64 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File FF Plugin HKU\S-1-5-21-87087875-2551032368-3624025436-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [No File] R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [40960 2017-03-31] (COMODO) R1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [831504 2017-03-31] (COMODO) R1 cmdHlp; C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [50808 2017-03-31] (COMODO) R1 inspect; C:\WINDOWS\system32\DRIVERS\inspect.sys [129200 2017-03-31] (COMODO) 2017-04-09 10:35 - 2017-04-17 21:42 - 00000000 ____D C:\Users\Egorka\AppData\Roaming\Comodo 2017-04-07 23:16 - 2017-04-07 23:16 - 03866608 _____ (COMODO) C:\WINDOWS\SysWOW64\ise_installer.exe 2017-04-07 15:18 - 2017-04-07 15:18 - 00000000 ____D C:\ProgramData\Comodo Downloader 2017-04-07 15:18 - 2017-04-05 08:58 - 00230592 _____ (COMODO) C:\WINDOWS\system32\cmdshim64.dll 2017-04-07 15:18 - 2017-04-05 08:56 - 00194752 _____ (COMODO) C:\WINDOWS\SysWOW64\cmdshim32.dll 2017-04-05 07:01 - 2017-04-05 07:01 - 00732368 _____ (COMODO) C:\WINDOWS\SysWOW64\guard32.dll 2017-04-05 07:01 - 2017-04-05 07:01 - 00051808 _____ (COMODO) C:\WINDOWS\system32\cmdcsr.dll 2017-04-05 07:00 - 2017-04-05 07:00 - 00941768 _____ (COMODO) C:\WINDOWS\system32\guard64.dll 2017-04-05 06:58 - 2017-04-05 06:58 - 00457408 _____ (COMODO) C:\WINDOWS\system32\cmdvrt64.dll 2017-04-05 06:56 - 2017-04-05 06:56 - 00363200 _____ (COMODO) C:\WINDOWS\SysWOW64\cmdvrt32.dll 2017-03-31 02:01 - 2017-03-31 02:01 - 00831504 _____ (COMODO) C:\WINDOWS\system32\Drivers\cmdguard.sys 2017-03-31 02:01 - 2017-03-31 02:01 - 00129200 _____ (COMODO) C:\WINDOWS\system32\Drivers\inspect.sys 2017-03-31 02:01 - 2017-03-31 02:01 - 00050808 _____ (COMODO) C:\WINDOWS\system32\Drivers\cmdhlp.sys 2017-03-31 02:01 - 2017-03-31 02:01 - 00040960 _____ (COMODO) C:\WINDOWS\system32\Drivers\cmderd.sys 2017-04-17 21:46 - 2016-08-25 23:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\COMODO 2017-04-17 21:46 - 2012-11-14 21:10 - 00000000 ____D C:\Program Files (x86)\Comodo 2017-04-09 10:51 - 2012-11-14 21:10 - 00000000 ____D C:\Users\Egorka\AppData\Local\Comodo COMODO Internet Security Premium (Version: 10.0.1.6209 - COMODO Security Solutions Inc.) Hidden <==== ATTENTION Task: {06CE1DAE-B629-4E70-87E9-8A4612FE7CF3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION Task: {0B0A02A9-E1B5-452E-8DFA-4B5AE0772ADC} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe Task: {0EC49FCD-FCA7-4D56-A7EF-54CF97FFE92E} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION Task: {0FE4D5E7-37DC-472C-9CD9-8B46AF8F9E1C} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe Task: {256ACDC0-6252-4910-9646-5BC6702D3662} - System32\Tasks\RunAsStdUser_GameCenterMailRu => C:\Users\Egorka\AppData\Local\Mail.Ru\GameCenter\[email protected] Task: {3013307B-D0BD-4AA5-88F7-5BFCF587DBDA} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION Task: {3081EDC0-969E-418B-AB3D-B0BC8F46C956} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION Task: {3C8C16EC-136E-43C3-AE22-ED33E6425098} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION Task: {4A2DDF3A-7283-4174-BDB6-36F05C4B0393} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION Task: {5A49820C-A9F0-4F50-AFCC-40136EF888A8} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe Task: {5D5D7AAC-3918-473F-8130-97B9B1D6373D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION Task: {61B24401-DC1C-46E7-A0D9-4D8D6C000F36} - System32\Tasks\GloSC_GameLauncher => C:\Program Task: {6566A35B-0C90-4241-9B08-C203287AE921} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION Task: {926335A6-C5AA-4293-AF63-B78837BF0BB7} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION Task: {9E73F506-ECF4-4EAA-A638-4B4E81449928} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION Task: {A4E9AD76-9082-44D8-9FA8-5B778F9DF72F} - System32\Tasks\COMODO\COMODO CMC {06A09C0F-DD9C-4191-A670-71115CD78627} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe Task: {DFFFB353-2848-49E3-9287-6D591288FB76} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION Task: {E08B2A15-C1CE-439C-B8AA-AD6A87426898} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe Task: {E84967F0-118C-488E-B1DA-385EAA04726A} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION Task: {EB042D34-DCA9-415C-985C-234441A04548} - \GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-87087875-2551032368-3624025436-1001 -> No File <==== ATTENTION AlternateDataStreams: C:\WINDOWS\explorer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\HelpPane.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\py.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\pyw.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\regedit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\splwow64.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\UNWISE.EXE:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aadcloudap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aadtb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AboveLockAppHost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\accountaccessor.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aclui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\acmigration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ActivationManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ActiveSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\actxprxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\adsmsext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aeinv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aepic.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\aitstatic.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\amdave64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\amdgfxinfo64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\amdhcp64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\amdlvr64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\amdmcl64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\amdmiracast.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\amdpcom64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\amdvlk64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\amfrt64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\AppCapture.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppContracts.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appinfo.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ApplicationFrame.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppointmentApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appraiser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppReadiness.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\apprepapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\apprepsync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appverif.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\appwiz.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppXApplicabilityBlob.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentServer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AppxPackaging.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ati2erec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atiapfxx.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\aticfx64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atidemgy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atidxx64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atieah64.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atig6txx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atimpc64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atimuixx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atisamu64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\atmfd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AudioEndpointBuilder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AudioEng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AUDIOKSE.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\AudioSes.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\audiosrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AudioSrvPolicyManager.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\AuthBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AuthHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\authui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\autoplay.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\AzureSettingSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\basecsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bcastdvr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BcastDVRHelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bcdedit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bcrypt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BingMaps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bisrv.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\BluetoothApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BluetoothDesktopHandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BootMenuUX.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\bootux.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\browserbroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BrowserSettingSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\BthRadioMedia.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CameraCaptureUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CbtBackgroundManagerPolicy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cdd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cdp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cdpreference.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cdpsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cdpusersvc.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\cemapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CertEnroll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\certprop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CfgSPCellular.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Chakra.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ChatApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ci.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\clinfo.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ClipUp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cloudAP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CloudBackupSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CloudExperienceHost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CloudExperienceHostBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CloudExperienceHostCommon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CloudExperienceHostUser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CloudStorageWizard.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\clusapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cmifw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\coinst_16.40.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\combase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\comdlg32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CompatTelRunner.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CompPkgSup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\comsvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ConsoleLogon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ContactApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CoreMessaging.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CoreUIComponents.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CPFilters.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CredProvDataModel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\credprovs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\crypt32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptngc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CryptoWinRT.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\cryptui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\CspCellularSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d2d1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d10warp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d11.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\D3D12.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d12SDKLayers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3d12warp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_43.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_47.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3dcsx_43.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3dref9.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3dx10_43.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\d3dx11_43.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\D3DX9_43.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dafBth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DafPrintProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DataSenseHandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DavSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\daxexec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dbgeng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dcntel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ddraw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ddrawex.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DelayAPO.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\detoured.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\deviceaccess.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceCensus.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceEnroller.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceFlows.DataModel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DevicePairing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DevicePairingFolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DeviceReactivation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\devinv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dfp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DfpCommon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dgtrayicon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dhcpcore6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\diagtrack.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dialclient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dialserver.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Display.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DisplayManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmcertinst.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dmenrollengine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DMRServer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dns-sd.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dnsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dnsrslvr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DolbyDecMFT.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\domgmt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dosvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dpapisrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\drvstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dsreg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DuCsps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dui70.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dwmcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DWrite.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DXCpl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\dxgi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\DXP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EAMProgressHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\edgehtml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EditBufferTestHook.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EditionUpgradeHelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EditionUpgradeManagerObj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EDPCleanup.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\efswrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EmailApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EncDec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\energy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\enrollmentapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EnterpriseAPNCsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\enterprisecsps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ErrorDetails.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\esent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\esentutl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\evr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ExplorerFrame.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ExSMime.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\facecredentialprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Family.SyncEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fhsettingsprovider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FlightSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FntCache.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fontdrvhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\FrameServer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\fveapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\GameManager64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\GamePanel.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\GamePanelExternalHook.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gameux.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gdi32full.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\GdiPlus.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\generaltel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Geolocation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\gpsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hevcdecoder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hgcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hsa-thunk64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\HttpsDataSource.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hvax64.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\hvix64.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hvloader.efi:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\hvloader.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\icfupgd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\icm32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\icsvcext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\IdCtrls.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ie4uinit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ieframe.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ieproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iertutil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\imapi2fs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ImplatSetup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\indexeddbserver.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\inetcomm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\inetcpl.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\input.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\InputLocaleManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\InputService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\InstallAgent.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\InstallAgentUserBroker.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\internetmail.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\invagent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\IPHLPAPI.DLL:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\iphlpsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ipnathlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iprtrmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\iscsiwmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\JpMapControl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\jscript9.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\kerberos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\KernelBase.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\KnobsCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\KnobsCsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LaunchWinApp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LicenseManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LkmdfCoInst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\localspl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LocationFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LockAppBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LockAppHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\LogonController.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lpremove.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lsasrv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\lsm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\main.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mantle64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mantleaxl64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MapConfiguration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MapControlCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MapGeocoder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MapRouter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MapsBtSvc.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\MapsStore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MbaeApiPublic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mbsmsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MCCSEngineShared.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MCRecvSrc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MDMAppInstaller.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mdmregistration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MediaFoundation.DefaultPerceptionProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfasfsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfaudiocnv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MFCaptureEngine.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\mfcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfksproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MFMediaEngine.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\mfmkvsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfmp4srcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfmpeg2srcsnk.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\mfnetcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfnetsrc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfplat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MFPlay.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mfsvr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\microsoft.windows.softwarelogo.showdesktop.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\migisol.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MiracastReceiver.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mispace.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mmc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MMDevAPI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\modernexecserver.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\moshost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\moshostcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MosStorage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mprddm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MPSSVC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MrmCoreR.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mscandui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msctf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msctfp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msctfui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdtcprx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdtctm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msdtcuiu.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msfeeds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msftedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mshtml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MsMiraDisp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msmpeg2vdec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mspaint.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSPhotography.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssitlb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssph.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssphtb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssprxy.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\mssrch.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mssvp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\mstscax.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msutb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msv1_0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSVP9DEC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msvproc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MSVPXENC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msxml3.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\msxml6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MultiDigiMon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\musdialoghandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MusNotification.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\MusNotificationUx.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\MusUpdateHandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NaturalLanguage6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ncsi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NetCfgNotifyObjectHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netiohlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netiougc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netplwiz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NetSetupShim.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\netshell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NetworkMobileSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ngccredprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NgcCtnr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NgcCtnrSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ngcsvc.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\nlasvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NMAA.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\NotificationController.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\nshwfp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntdll.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\ntoskrnl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ntshrui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\odbcconf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\offlinesam.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\offreg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ole32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\oleacc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OnDemandConnRouteHelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OneBackupHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OpenAL32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\OpenCL.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pcasvc.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\PCPTpm12.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PhotoScreensaver.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PimIndexMaintenance.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Pimstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PlayToDevice.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PlayToManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PlayToReceiver.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\pnidui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\policymanager.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\poqexec.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\powercfg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PrintDialogs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PrintDialogs3D.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\PrintRenderAPIHost.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\provengine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ProvPluginEng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ProvSysprep.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\puiapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\puiobj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\qmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\quartz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RADCUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasapi32.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\rascustom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasgcw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rasmans.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdpcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdpcorets.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdpencom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\rdpudd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RDXService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RDXTaskFactory.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ReAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ReAgentc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RelPost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\remoteaudioendpoint.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RemoteNaturalLanguage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ReportingCSP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\reseteng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ResetEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\resutils.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RjvMDMConfig.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RTMediaFrame.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\RTWorkQ.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\samsrv.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\ScDeviceEnum.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\schannel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\scksp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sdengin2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sdshext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SearchFilterHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SearchFolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SearchIndexer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SearchProtocolHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SecConfig.efi:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\securekernel.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sendmail.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SensorDataService.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\services.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SET1571.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SET3250.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SET3271.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SET335F.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SET4ACB.tmp:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\SET93B6.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SET9445.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETA376.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETA4A1.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETBA83.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETBB02.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETBB7A.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETC83A.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETD9D3.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETD9F4.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETDBCD.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETE37F.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETFA80.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SETFBBA.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers_Bluetooth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers_Flights.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers_nt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers_WorkAccess.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingSyncCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SettingSyncHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\setupugc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SharedStartModel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ShareHost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SHCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shell32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\shutdownux.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\smartscreen.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SndVolSSO.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SpaceAgent.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SpaceControl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spaceman.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SpeechPal.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\spoolsv.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sppnp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sppobjs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sppsvc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sppwinob.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SRH.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SRHInproc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sspicli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\stobject.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\storagewmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\StoreAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\StorSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\StructuredQuery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\sud.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SyncCenter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SyncSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\systemreset.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemSettings.Handlers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsAdminFlows.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Tabbtn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tabcal.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TabletPC.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\taskbarcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tbauth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TextInputFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\themecpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\thumbcache.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TokenBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TokenBrokerCookies.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TpmCoreProvisioning.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TpmTasks.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tquery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\TSWorkspace.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\twinapi.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\twinapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\twinui.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\twinui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\twinui.pcshell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\tzautoupdate.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\ubpm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\uDWM.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UIAutomationCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UIRibbon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UIRibbonRes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\umpoext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\unimdm.tsp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Unistore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\updatehandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\updatepolicy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\uReFS.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\urlmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\usbaaplrc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\user32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\usercpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UserDataService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UserDataTimeUtil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UserDeviceRegistration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UserDeviceRegistration.Ngc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UserLanguagesCpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UserMgrProxy.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\usoapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\usocore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\UtcResources.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vaultcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vbscript.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VCardParser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vds.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VEStoreEventHandlers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vmnetbridge.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vnetinst.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vpnike.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VPNv2CSP.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VSD3DWARP12Debug.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VSD3DWARPDebug.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VsGraphicsDesktopEngine.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vssapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\VSSVC.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\vulkaninfo-1-1-0-17-0.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vulkaninfo-1-1-0-26-0.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\vulkaninfo.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wbengine.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wbiosrvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wcmsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wcnwiz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wc_storage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WdfCoInstaller01009.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WdfCoInstaller01011.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WebcamUi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\werconcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\werui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wfdprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wifinetworkmanager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\win32k.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\win32kbase.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\win32kfull.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\win32spl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wincorlib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.AccountsControl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Core.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Wallet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Cortana.Desktop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Cortana.OneCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Data.Pdf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.AllJoyn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.LowLevel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Midi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Perception.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Picker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.PointOfService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Radios.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Scanners.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Sensors.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.SerialCommunication.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.SmartCards.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.SmartCards.Phone.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Usb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.WiFi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.WiFiDirect.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Gaming.Input.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Gaming.UI.GameBar.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Gaming.XboxLive.Storage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Globalization.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Graphics.Printing.3D.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Graphics.Printing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Internal.Management.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Audio.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Editing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.FaceAnalysis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Import.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.MediaControl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Speech.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Streaming.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.Connectivity.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.HostName.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.ServiceDiscovery.Dnssd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.UX.EapRequestHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Perception.Stub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Authentication.Identity.Provider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Credentials.UI.UserConsentVerifier.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.StateRepository.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.StateRepositoryClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\windows.storage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Storage.Search.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.System.SystemManagement.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.BioFeedback.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Cred.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.CredDialogController.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Immersive.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Input.Inking.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Logon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Search.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Shell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Xaml.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Xaml.Maps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Xaml.Phone.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Web.Diagnostics.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Web.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Windows.Web.Http.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WindowsCodecs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winhttp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wininet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winload.efi:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winload.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winlogon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winmde.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winresume.efi:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winresume.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinRtTracing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinSCard.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WinSetupUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winspool.drv:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\winsrv.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\wintrust.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\WinTypes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wkssvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlanapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WlanMediaManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlansec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlansvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlanui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlidprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wlidsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMPDMC.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmpdxm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmpeffects.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmpmde.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmpps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wmpshell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WMVDECOD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WordBreakers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WorkFolders.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WorkfoldersControl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WorkFoldersGPExt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WorkFoldersShell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\workfolderssvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wow64.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WpAXHolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Wpc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WpcMon.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WpcWebFilter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpnapps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpncore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpninprc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpnprv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wpx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wrap_oal.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wscapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wscinterop.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wscsvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wscui.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsecedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WSManHTTPConfig.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WsmSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WsmWmiPl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsp_fs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsp_health.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wsp_sr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wu.upgrade.ps.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\wuapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wuaueng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wups.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wuuhext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WwaApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WWAHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\WWanAPI.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\wwanconn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wwanmm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\wwansvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_7.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xactengine3_6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xactengine3_7.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_4.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_5.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XAudio2_6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XAudio2_7.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XblAuthManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XblGameSaveExt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XboxNetApiSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\XInputUap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xpsrchvw.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xrhr1alm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\xrhr1ausb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\zipfldr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\aadtb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AboveLockAppHost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\accountaccessor.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\aclui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ActivationManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\actxprxy.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\adsmsext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\aepic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\amdave32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\amdgfxinfo32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\amdhcp32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\amdlvr32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\amdmcl32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\amdpcom32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\amdvlk32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\amfrt32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AppCapture.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AppContracts.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AppointmentApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\apprepapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\apprepsync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\appverif.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\appwiz.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AppxPackaging.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\atiadlxx.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\atiadlxy.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\aticfx32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\atidxx32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\atigktxx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\atimpc32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\atisamu32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\atmfd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AUDIOKSE.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioSes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\authui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\autoplay.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\azroleui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\basecsp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bcastdvr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\BcastDVRHelper.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\bcrypt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\BingMaps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\BluetoothApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\BrowserSettingSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CameraCaptureUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cdp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cemapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CertEnroll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Chakra.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Chakradiag.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ChatApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudBackupSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudExperienceHostUser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudStorageWizard.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\clusapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cmifw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\combase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\comdlg32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CompPkgSup.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\comsvcs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ConfigureExpandedStorage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ContactApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CoreMessaging.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CoreUIComponents.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CPFilters.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CredProvDataModel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\credprovs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\crypt32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptngc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\CryptoWinRT.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d2d1.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10warp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d11.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\D3D12.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d12SDKLayers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d12warp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_39.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_43.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_47.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dcsx_43.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_39.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_43.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx11_43.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_39.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_43.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DafPrintProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DavSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\daxexec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dbgeng.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ddraw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ddrawex.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\detoured.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\deviceaccess.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceFlows.DataModel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DevicePairing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcore6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dialclient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DisplayManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dmenrollengine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dns-sd.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dnsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DolbyDecMFT.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dplaysvr.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\drvstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dsreg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dtdump.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dwmcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DWrite.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\DXCpl.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\dxgi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\EasyAntiCheat.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\edgehtml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\EditBufferTestHook.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\efswrt.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\EmailApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ErrorDetails.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\esent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\esentutl.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\evr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\explorer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ExplorerFrame.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\ExSMime.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\findnetprinters.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerApp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fontdrvhost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\fontext.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\GameManager32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\GamePanelExternalHook.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\gameux.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\gdi32full.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\GdiPlus.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Geolocation.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\gpapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hevcdecoder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hgcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\hsa-thunk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\icm32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ieframe.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ieproxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iertutil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\imapi2fs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\indexeddbserver.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcomm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcpl.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\input.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\InputLocaleManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\InputService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\InstallAgent.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\IPHLPAPI.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iprtrmgr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsiwmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\javaws.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\JpMapControl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9diag.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\kerberos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\KernelBase.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\LaunchWinApp.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\LicenseManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\LockAppBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\LockAppHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\LogonController.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\main.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mantle32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mantleaxl32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MapConfiguration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MapControlCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MapGeocoder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MapRouter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MapsBtSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MbaeApiPublic.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mbsmsapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MCCSEngineShared.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MCRecvSrc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mdmregistration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfaudiocnv.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfcore.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfksproxy.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\MFMediaEngine.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfnetcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfnetsrc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfplat.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MFPlay.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsrcsnk.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsvr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\migisol.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MiracastReceiver.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mispace.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mmc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MMDevAPI.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\mos.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MosStorage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mprddm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MrmCoreR.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mscandui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mscms.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msctf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msctfp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msctfui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msdtcprx.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msdtcuiu.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeeds.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msftedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msmpeg2vdec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mspaint.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSPhotography.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssitlb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssph.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssphtb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssrch.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mssvp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mstsc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mstscax.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msutb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msv1_0.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVP9DEC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msvproc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVPXENC.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msxml3.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\msxml6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxclu.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NaturalLanguage6.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\NetCfgNotifyObjectHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netiohlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netiougc.exe:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\NetSetupShim.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\netshell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ngccredprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\NMAA.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\nshwfp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ntdll.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ntshrui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcconf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\offlinesam.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\offreg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ole32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\oleacc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\olepro32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\OneDriveSetup.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\OpenAL32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\OpenCL.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PCPTpm12.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PhotoScreensaver.scr:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Pimstore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToDevice.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToManager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToReceiver.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\policymanager.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\poqexec.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\powercfg.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PrintConfig.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\PrintDialogs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ProximityCommon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\puiapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\puiobj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\quartz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RADCUI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasapi32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rasgcw.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rdpcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\rdpencom.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ReAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ReAgentc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\regedit.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\resutils.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\RTMediaFrame.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\RTWorkQ.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\schannel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\scksp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchFilterHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchFolder.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchIndexer.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchProtocolHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sendmail.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET16EA.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET1863.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET1971.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET1F32.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET2176.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET317F.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET35B4.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET4772.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET47C2.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET4813.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET4843.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SET97E5.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETA2F5.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETA365.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETA3F3.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETBCD4.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETBE6C.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETBF5B.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETC309.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETC4B1.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETD67F.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETDE51.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETEF67.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETF024.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETF0C3.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SETF0F4.tmp:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSync.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSyncCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSyncHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\setupugc.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\ShareHost.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SHCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\shell32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SndVolSSO.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sspicli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\stobject.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\storagewmi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\StoreAgent.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\StructuredQuery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\sud.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncSettings.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\systemcpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tapi32.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\tbauth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tcpipcfg.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TextInputFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\themecpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\thumbcache.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TokenBroker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TokenBrokerCookies.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\tquery.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\TSWorkspace.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\twinapi.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\twinapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.appcore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UIAutomationCore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UIRibbon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UIRibbonRes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\unimdm.tsp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Unistore.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\unrar.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\updatepolicy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\uReFS.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\urlmon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\user32.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\usercpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDataAccountApis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDeviceRegistration.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDeviceRegistration.Ngc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\UserMgrProxy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\usoapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vaultcli.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vbscript.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\VCardParser.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\VSD3DWARP12Debug.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\VSD3DWARPDebug.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\VsGraphicsDesktopEngine.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vsjitdebugger.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vsocklib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vssapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vulkaninfo-1-1-0-17-0.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vulkaninfo-1-1-0-26-0.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\vulkaninfo.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wcnwiz.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WebcamUi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wfdprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\win32k.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\win32kfull.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wincorlib.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.AccountsControl.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.AllJoyn.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.LowLevel.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Midi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Perception.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Picker.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.PointOfService.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Radios.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.SerialCommunication.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.SmartCards.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.WiFi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.WiFiDirect.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Gaming.Input.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Gaming.UI.GameBar.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Gaming.XboxLive.Storage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Globalization.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.3D.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Editing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.FaceAnalysis.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Import.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.MediaControl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Ocr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.HostName.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.ServiceDiscovery.Dnssd.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Identity.Provider.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Speech.Pal.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.StateRepository.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\windows.storage.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Storage.Search.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.System.SystemManagement.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.CredDialogController.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Search.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Maps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Web.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Web.Http.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WindowsCodecs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winhttp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wininet.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\winmde.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinRtTracing.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSCard.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\winspool.drv:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wintrust.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WinTypes.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanui.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wlidprov.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMPDMC.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpdxm.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpeffects.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpmde.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpshell.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WMVSENCD.DLL:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WordBreakers.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\Wpc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WpcWebFilter.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WPDShServiceObj.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wpnapps.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wrap_oal.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wscapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wscinterop.dll:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\SysWOW64\wscui.cpl:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wsecedit.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WSManHTTPConfig.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmSvc.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmWmiPl.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wsp_fs.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wsp_health.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wsp_sr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\wuapi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WwaApi.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\WWAHost.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_7.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_7.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_4.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_5.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_6.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_7.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\XInputUap.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xolehlp.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\xpsrchvw.exe:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\SysWOW64\zipfldr.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\afd.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ahcache.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\amdacpksd.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\amdkmafd.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ati2erec.dll:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\AtihdWT6.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\atikmdag.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\atikmpag.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\capimg.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\Classpnp.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\clfs.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\cng.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\crashdmp.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dam.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dbx-canary.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dbx-dev.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dbx-stable.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dfsc.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dumpsd.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dxgkrnl.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dxgmms1.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\dxgmms2.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\fastfat.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidclass.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\http.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\hvsocket.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\IPMIDrv.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ks.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\LEqdUsb.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\LHidEqd.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\MegaSas2i.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\modem.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxdav.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb10.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb20.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\mskssrv.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndis.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\netaapl64.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ntfs.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\nwifi.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\partmgr.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\pci.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\pdc.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdbss.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\SaiBus.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\SaiK1705.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\SaiMini.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\SaiU1705.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdbus.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\SET321F.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\SET3235.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\SET72D8.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\SETD9A2.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\SETF9C2.tmp:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\spaceport.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\srv.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\srv2.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\storahci.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\storport.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\tcpip.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\tcpipreg.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\tdx.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\teamviewervpn.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\Thetta64.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\tm.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\tpm.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbaapl64.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\VBoxDrv.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\VBoxNetAdp6.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\VBoxNetLwf.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vhdmp.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\ViGEmBus.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmbkmcl.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmbkmclr.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmci.sys:$CmdTcID [130] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmnet.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmnetadapter.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\vmnetbridge.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdiWiFi.sys:$CmdTcID [64] AlternateDataStreams: C:\WINDOWS\system32\Drivers\xboxgip.sys:$CmdTcID [64] AlternateDataStreams: C:\Users\Egorka\Desktop\Huawei R&D Russia 2017-03-15.pdf:$CmdZnID [26] AlternateDataStreams: C:\Users\Egorka\Desktop\Results+for+experts+-+03-04-2017.docx:$CmdTcID [64] AlternateDataStreams: C:\Users\Egorka\Desktop\Results+for+experts+-+03-04-2017.docx:$CmdZnID [26] HKLM\...\StartupApproved\StartupFolder: => "Start GeekBuddy.lnk" HKU\S-1-5-21-87087875-2551032368-3624025436-1001\...\StartupApproved\Run: => "Pando Media Booster" HKU\S-1-5-21-87087875-2551032368-3624025436-1001\...\StartupApproved\Run: => "GameCenterMailRu" Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\COMODO\COMODO Internet Security Premium.lnk -> C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe (No File) Shortcut: C:\Users\Egorka\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\724e6c6e1aea27c4\COMODO Internet Security.lnk -> C:\Program Files\COMODO\COMODO Internet Security\cis.exe (No File) Shortcut: C:\Users\Все пользователи\Microsoft\Windows\Start Menu\Programs\COMODO\COMODO Internet Security Premium.lnk -> C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe (No File) Reboot:
Отключите до перезагрузки антивирус, закройте все браузеры, запустите FRST, нажмите Fix и подождите. Программа создаст лог-файл (Fixlog.txt). Прикрепите его к своему следующему сообщению.
Компьютер будет перезагружен автоматически.
На рабочем столе будет создан архив .ZIP с именем, состоящим из даты и времени выполнения фикса, загрузите его в доступное облачное хранилище или на файлообменник (rghost.ru, например) и дайте ссылку в теме.
Сообщите, что с проблемой.
WBR,
Vadim
Добрый день.
Fixlog.txt в аттаче, zip архив на рабочем столе не нашел. ping на 127.0.0.1 теперь проходит, при ping на ip адрес роутера выдает "PING: сбой передачи. Общий сбой". Интернета, по понятным причинам, нет.
Скачайте Windows Repair (All In One), распакуйте, запустите, закладка "Repairs", "Open Repairs", отметьте пункт 13 "Repair network" и нажмите "Start Repairs".
После перезагрузки проверяйте работу интернета.
WBR,
Vadim
Пока что тоже самое, 127.0.0.1 пингуется, при подключении к wi-fi проблемы (пробовал на 2ух wi-fi точках).
А на проводном подключении пробовали? Может, драйвера слетели?
WBR,
Vadim
Это не очень легко сделать из-за удаленности от роутера. Вчера пробовал заново установить драйвера для wi-fi, ничего не вышло. Сегодня еще раз попробую удалить, перезапустить и с нуля поставить wi-fi. Могу еще попробовать другой wi-fi адаптер.
Попробуйте, нужно на другом сетевом подключении проверить.
WBR,
Vadim
Добрый день. Пробовал через другой wi-fi адаптор и телефон - ничего не работает. Попробовал в безопасном режиме - также, ничего не работает. Драйвер переустанавливал по-всякому, с перезагрузкой, с оффсайта, по-умолчанию, ничего не помогает.
- - - - -Добавлено - - - - -
Да уж, ну и проблема, удалил Comodo Internet Security Firewall Driver из компонентов подключение. Вообще случайно на него глазами наткнулся. Все заработало. Спасибо за помощь.
Видимо, единственный компонент от Comodo, который недочистили. Но копали в правильном направлении
Удалите все установленные версии Java, они устаревшие и со множеством критических уязвимостей.
Если Java вообще нужна для каких- либо приложений, игр - установите Java 8 Update 121.
Учтите, что 64-bit версия Java нужна только для очень ограниченного круга приложений.
WBR,
Vadim
Уважаемый(ая) Egor Kromberg, наши специалисты оказали Вам всю возможную помощь по вашему обращению.
В целях поддержания безопасности вашего компьютера настоятельно рекомендуем:
Чтобы всегда быть в курсе актуальных угроз в области информационной безопасности и сохранять свой компьютер защищенным, рекомендуем следить за последними новостями ИТ-сферы портала Anti-Malware.ru:
Надеемся больше никогда не увидеть ваш компьютер зараженным!
Если Вас не затруднит, пополните пожалуйста нашу базу безопасных файлов.
Ваши права в разделе
