splunk-security_content/lookups/lolbas_file_path.csv at data_source_bug_fix

mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00

Files

T

pyth0n1c 29b2332652 more cleanup of lookups to follow new format.

this involved renaming some CSVs to remove the
dates from them or force their naming schema to
match the corresponding YML name for CSV
detections

2025-01-03 10:27:49 -08:00

50 KiB

Raw Permalink Blame History

1	lolbas_file_name	lolbas_file_path	description
2	eventvwr.exe	c:\windows\system32\*	Displays Windows Event Logs in a GUI window.
3	eventvwr.exe	c:\windows\syswow64\*	Displays Windows Event Logs in a GUI window.
4	rasautou.exe	c:\windows\system32\*	Windows Remote Access Dialer
5	regedit.exe	c:\windows\*	Used by Windows to manipulate registry
6	regedit.exe	c:\windows\syswow64\*	Used by Windows to manipulate registry
7	regsvr32.exe	c:\windows\system32\*	Used by Windows to register dlls
8	regsvr32.exe	c:\windows\syswow64\*	Used by Windows to register dlls
9	control.exe	c:\windows\system32\*	Binary used to launch controlpanel items in Windows
10	control.exe	c:\windows\syswow64\*	Binary used to launch controlpanel items in Windows
11	configsecuritypolicy.exe	c:\programdata\microsoft\windows defender\platform\*	Binary part of Windows Defender. Used to manage settings in Windows Defender. you can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
12	configsecuritypolicy.exe	c:\program files\windows defender\*	Binary part of Windows Defender. Used to manage settings in Windows Defender. you can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
13	configsecuritypolicy.exe	c:\program files\microsoft security client\*	Binary part of Windows Defender. Used to manage settings in Windows Defender. you can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
14	scriptrunner.exe	c:\windows\system32\*	Execute binary through proxy binary to evade defensive counter measures
15	scriptrunner.exe	c:\windows\syswow64\*	Execute binary through proxy binary to evade defensive counter measures
16	offlinescannershell.exe	c:\program files\windows defender\offline\*	Windows Defender Offline Shell
17	atbroker.exe	c:\windows\system32\*	Helper binary for Assistive Technology (AT)
18	atbroker.exe	c:\windows\syswow64\*	Helper binary for Assistive Technology (AT)
19	mmc.exe	c:\windows\system32\*	Load snap-ins to locally and remotely manage Windows systems
20	mmc.exe	c:\windows\syswow64\*	Load snap-ins to locally and remotely manage Windows systems
21	mavinject.exe	c:\windows\system32\*	Used by App-v in Windows
22	mavinject.exe	c:\windows\syswow64\*	Used by App-v in Windows
23	ftp.exe	c:\windows\system32\*	A binary designed for connecting to FTP servers
24	ftp.exe	c:\windows\syswow64\*	A binary designed for connecting to FTP servers
25	ttdinject.exe	c:\windows\system32\*	Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
26	ttdinject.exe	c:\windows\syswow64\*	Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
27	certoc.exe	c:\windows\system32\*	Used for installing certificates
28	certoc.exe	c:\windows\syswow64\*	Used for installing certificates
29	at.exe	c:\windows\system32\*	Schedule periodic tasks
30	at.exe	c:\windows\syswow64\*	Schedule periodic tasks
31	netsh.exe	c:\windows\system32\*	Netsh is a Windows tool used to manipulate network interface settings.
32	netsh.exe	c:\windows\syswow64\*	Netsh is a Windows tool used to manipulate network interface settings.
33	pnputil.exe	c:\windows\system32\*	Used for installing drivers
34	ie4uinit.exe	c:\windows\system32\*	Executes commands from a specially prepared ie4uinit.inf file.
35	ie4uinit.exe	c:\windows\syswow64\*	Executes commands from a specially prepared ie4uinit.inf file.
36	infdefaultinstall.exe	c:\windows\system32\*	Binary used to perform installation based on content inside inf files
37	infdefaultinstall.exe	c:\windows\syswow64\*	Binary used to perform installation based on content inside inf files
38	forfiles.exe	c:\windows\system32\*	Selects and executes a command on a file or set of files. This command is useful for batch processing.
39	forfiles.exe	c:\windows\syswow64\*	Selects and executes a command on a file or set of files. This command is useful for batch processing.
40	register-cimprovider.exe	c:\windows\system32\*	Used to register new wmi providers
41	register-cimprovider.exe	c:\windows\syswow64\*	Used to register new wmi providers
42	tttracer.exe	c:\windows\system32\*	Used by Windows 1809 and newer to Debug Time Travel
43	tttracer.exe	c:\windows\syswow64\*	Used by Windows 1809 and newer to Debug Time Travel
44	xwizard.exe	c:\windows\system32\*	Execute custom class that has been added to the registry or download a file with Xwizard.exe
45	xwizard.exe	c:\windows\syswow64\*	Execute custom class that has been added to the registry or download a file with Xwizard.exe
46	pcalua.exe	c:\windows\system32\*	Program Compatibility Assistant
47	print.exe	c:\windows\system32\*	Used by Windows to send files to the printer
48	print.exe	c:\windows\syswow64\*	Used by Windows to send files to the printer
49	runscripthelper.exe	c:\windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.15_none_c2df1bba78111118\*	Execute target PowerShell script
50	runscripthelper.exe	c:\windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.192_none_ad4699b571e00c4a\*	Execute target PowerShell script
51	regasm.exe	c:\windows\microsoft.net\framework\v2.0.50727\*	Part of .NET
52	regasm.exe	c:\windows\microsoft.net\framework64\v2.0.50727\*	Part of .NET
53	regasm.exe	c:\windows\microsoft.net\framework\v4.0.30319\*	Part of .NET
54	regasm.exe	c:\windows\microsoft.net\framework64\v4.0.30319\*	Part of .NET
55	cmd.exe	c:\windows\system32\*	The command-line interpreter in Windows
56	cmd.exe	c:\windows\syswow64\*	The command-line interpreter in Windows
57	msbuild.exe	c:\windows\microsoft.net\framework\v2.0.50727\*	Used to compile and execute code
58	msbuild.exe	c:\windows\microsoft.net\framework64\v2.0.50727\*	Used to compile and execute code
59	msbuild.exe	c:\windows\microsoft.net\framework\v3.5\*	Used to compile and execute code
60	msbuild.exe	c:\windows\microsoft.net\framework64\v3.5\*	Used to compile and execute code
61	msbuild.exe	c:\windows\microsoft.net\framework\v4.0.30319\*	Used to compile and execute code
62	msbuild.exe	c:\windows\microsoft.net\framework64\v4.0.30319\*	Used to compile and execute code
63	msbuild.exe	c:\program files (x86)\msbuild\14.0\bin\*	Used to compile and execute code
64	certutil.exe	c:\windows\system32\*	Windows binary used for handling certificates
65	certutil.exe	c:\windows\syswow64\*	Windows binary used for handling certificates
66	vbc.exe	c:\windows\microsoft.net\framework\v\	Binary file used for compile vbs code
67	vbc.exe	c:\windows\microsoft.net\framework64\v\	Binary file used for compile vbs code
68	psr.exe	c:\windows\system32\*	Windows Problem Steps Recorder, used to record screen and clicks.
69	psr.exe	c:\windows\syswow64\*	Windows Problem Steps Recorder, used to record screen and clicks.
70	extexport.exe	c:\program files\internet explorer\*	Load a DLL located in the c:\test folder with a specific name.
71	extexport.exe	c:\program files (x86)\internet explorer\*	Load a DLL located in the c:\test folder with a specific name.
72	rpcping.exe	c:\windows\system32\*	Used to verify rpc connection
73	rpcping.exe	c:\windows\syswow64\*	Used to verify rpc connection
74	msdt.exe	c:\windows\system32\*	Microsoft diagnostics tool
75	msdt.exe	c:\windows\syswow64\*	Microsoft diagnostics tool
76	gfxdownloadwrapper.exe	c:\windows\system32\driverstore\filerepository\*	Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path.
77	dnscmd.exe	c:\windows\system32\*	A command-line interface for managing DNS servers
78	dnscmd.exe	c:\windows\syswow64\*	A command-line interface for managing DNS servers
79	wab.exe	c:\program files\windows mail\*	Windows address book manager
80	wab.exe	c:\program files (x86)\windows mail\*	Windows address book manager
81	msconfig.exe	c:\windows\system32\*	MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows
82	wscript.exe	c:\windows\system32\*	Used by Windows to execute scripts
83	wscript.exe	c:\windows\syswow64\*	Used by Windows to execute scripts
84	makecab.exe	c:\windows\system32\*	Binary to package existing files into a cabinet (.cab) file
85	makecab.exe	c:\windows\syswow64\*	Binary to package existing files into a cabinet (.cab) file
86	datasvcutil.exe	c:\windows\microsoft.net\framework64\v3.5\*	DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application.
87	cmdl32.exe	c:\windows\system32\*	Microsoft Connection Manager Auto-Download
88	cmdl32.exe	c:\windows\syswow64\*	Microsoft Connection Manager Auto-Download
89	mshta.exe	c:\windows\system32\*	Used by Windows to execute html applications. (.hta)
90	mshta.exe	c:\windows\syswow64\*	Used by Windows to execute html applications. (.hta)
91	cmdkey.exe	c:\windows\system32\*	creates, lists, and deletes stored user names and passwords or credentials.
92	cmdkey.exe	c:\windows\syswow64\*	creates, lists, and deletes stored user names and passwords or credentials.
93	ilasm.exe	c:\windows\microsoft.net\framework\v4.0.30319\*	used for compile c# code into dll or exe.
94	ilasm.exe	c:\windows\microsoft.net\framework64\v4.0.30319\*	used for compile c# code into dll or exe.
95	rdrleakdiag.exe	c:\windows\system32\*	Microsoft Windows resource leak diagnostic tool
96	rdrleakdiag.exe	c:\windows\syswow64\*	Microsoft Windows resource leak diagnostic tool
97	mpcmdrun.exe	c:\program files\windows defender\*	Binary part of Windows Defender. Used to manage settings in Windows Defender
98	mpcmdrun.exe	c:\programdata\microsoft\windows defender\platform\*	Binary part of Windows Defender. Used to manage settings in Windows Defender
99	mpcmdrun.exe	c:\program files\microsoft security client\*	Binary part of Windows Defender. Used to manage settings in Windows Defender
100	jsc.exe	c:\windows\microsoft.net\framework\v4.0.30319\*	Binary file used by .NET to compile javascript code to .exe or .dll format
101	jsc.exe	c:\windows\microsoft.net\framework64\v4.0.30319\*	Binary file used by .NET to compile javascript code to .exe or .dll format
102	jsc.exe	c:\windows\microsoft.net\framework\v2.0.50727\*	Binary file used by .NET to compile javascript code to .exe or .dll format
103	jsc.exe	c:\windows\microsoft.net\framework64\v2.0.50727\*	Binary file used by .NET to compile javascript code to .exe or .dll format
104	cmstp.exe	c:\windows\system32\*	Installs or removes a Connection Manager service profile.
105	cmstp.exe	c:\windows\syswow64\*	Installs or removes a Connection Manager service profile.
106	stordiag.exe	c:\windows\system32\*	Storage diagnostic tool
107	stordiag.exe	c:\windows\syswow64\*	Storage diagnostic tool
108	odbcconf.exe	c:\windows\system32\*	Used in Windows for managing ODBC connections
109	odbcconf.exe	c:\windows\syswow64\*	Used in Windows for managing ODBC connections
110	wlrmdr.exe	c:\windows\system32\*	Windows Logon Reminder executable
111	printbrm.exe	c:\windows\system32\spool\tools\*	Printer Migration Command-Line Tool
112	dfsvc.exe	c:\windows\microsoft.net\framework\v2.0.50727\*	ClickOnce engine in Windows used by .NET
113	dfsvc.exe	c:\windows\microsoft.net\framework64\v2.0.50727\*	ClickOnce engine in Windows used by .NET
114	dfsvc.exe	c:\windows\microsoft.net\framework\v4.0.30319\*	ClickOnce engine in Windows used by .NET
115	dfsvc.exe	c:\windows\microsoft.net\framework64\v4.0.30319\*	ClickOnce engine in Windows used by .NET
116	extrac32.exe	c:\windows\system32\*	Extract to ADS, copy or overwrite a file with Extrac32.exe
117	extrac32.exe	c:\windows\syswow64\*	Extract to ADS, copy or overwrite a file with Extrac32.exe
118	rundll32.exe	c:\windows\system32\*	Used by Windows to execute dll files
119	rundll32.exe	c:\windows\syswow64\*	Used by Windows to execute dll files
120	runonce.exe	c:\windows\system32\*	Executes a Run Once Task that has been configured in the registry
121	runonce.exe	c:\windows\syswow64\*	Executes a Run Once Task that has been configured in the registry
122	explorer.exe	c:\windows\*	Binary used for managing files and system components within Windows
123	explorer.exe	c:\windows\syswow64\*	Binary used for managing files and system components within Windows
124	wuauclt.exe	c:\windows\system32\*	Windows Update Client
125	wsreset.exe	c:\windows\system32\*	Used to reset Windows Store settings according to its manifest file
126	finger.exe	c:\windows\system32\*	Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
127	finger.exe	c:\windows\syswow64\*	Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
128	regini.exe	c:\windows\system32\*	Used to manipulate the registry
129	regini.exe	c:\windows\syswow64\*	Used to manipulate the registry
130	reg.exe	c:\windows\system32\*	Used to manipulate the registry
131	reg.exe	c:\windows\syswow64\*	Used to manipulate the registry
132	syncappvpublishingserver.exe	c:\windows\system32\*	Used by App-v to get App-v server lists
133	syncappvpublishingserver.exe	c:\windows\syswow64\*	Used by App-v to get App-v server lists
134	bitsadmin.exe	c:\windows\system32\*	Used for managing background intelligent transfer
135	bitsadmin.exe	c:\windows\syswow64\*	Used for managing background intelligent transfer
136	msiexec.exe	c:\windows\system32\*	Used by Windows to execute msi files
137	msiexec.exe	c:\windows\syswow64\*	Used by Windows to execute msi files
138	regsvcs.exe	c:\windows\system32\*	Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
139	regsvcs.exe	c:\windows\syswow64\*	Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
140	gpscript.exe	c:\windows\system32\*	Used by group policy to process scripts
141	gpscript.exe	c:\windows\syswow64\*	Used by group policy to process scripts
142	diskshadow.exe	c:\windows\system32\*	Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
143	diskshadow.exe	c:\windows\syswow64\*	Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
144	ieexec.exe	c:\windows\microsoft.net\framework\v2.0.50727\*	The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
145	ieexec.exe	c:\windows\microsoft.net\framework64\v2.0.50727\*	The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
146	diantz.exe	c:\windows\system32\*	Binary that package existing files into a cabinet (.cab) file
147	diantz.exe	c:\windows\syswow64\*	Binary that package existing files into a cabinet (.cab) file
148	desktopimgdownldr.exe	c:\windows\system32\*	Windows binary used to configure lockscreen/desktop image
149	appinstaller.exe	c:\program files\windowsapps\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe\*	Tool used for installation of AppX/MSIX applications on Windows 10
150	sc.exe	c:\windows\system32\*	Used by Windows to manage services
151	sc.exe	c:\windows\syswow64\*	Used by Windows to manage services
152	replace.exe	c:\windows\system32\*	Used to replace file with another file
153	replace.exe	c:\windows\syswow64\*	Used to replace file with another file
154	schtasks.exe	c:\windows\system32\*	Schedule periodic tasks
155	schtasks.exe	c:\windows\syswow64\*	Schedule periodic tasks
156	microsoft.workflow.compiler.exe	c:\windows\microsoft.net\framework64\v4.0.30319\*	A utility included with .NET that is capable of compiling and executing C# or VB.net code.
157	expand.exe	c:\windows\system32\*	Binary that expands one or more compressed files
158	expand.exe	c:\windows\syswow64\*	Binary that expands one or more compressed files
159	conhost.exe	c:\windows\system32\*	Console Window host
160	bash.exe	c:\windows\system32\*	File used by Windows subsystem for Linux
161	bash.exe	c:\windows\syswow64\*	File used by Windows subsystem for Linux
162	pcwrun.exe	c:\windows\system32\*	Program Compatibility Wizard
163	fltmc.exe	c:\windows\system32\*	Filter Manager Control Program used by Windows
164	wmic.exe	c:\windows\system32\wbem\*	The WMI command-line (WMIC) utility provides a command-line interface for WMI
165	wmic.exe	c:\windows\syswow64\wbem\*	The WMI command-line (WMIC) utility provides a command-line interface for WMI
166	workfolders.exe	c:\windows\system32\*	Work Folders
167	settingsynchost.exe	c:\windows\system32\*	Host Process for Setting Synchronization
168	settingsynchost.exe	c:\windows\syswow64\*	Host Process for Setting Synchronization
169	pktmon.exe	c:\windows\system32\*	Capture Network Packets on the windows 10 with October 2018 Update or later.
170	pktmon.exe	c:\windows\syswow64\*	Capture Network Packets on the windows 10 with October 2018 Update or later.
171	aspnet_compiler.exe	c:\windows\microsoft.net\framework\v4.0.30319\*	ASP.NET Compilation Tool
172	aspnet_compiler.exe	c:\windows\microsoft.net\framework64\v4.0.30319\*	ASP.NET Compilation Tool
173	cscript.exe	c:\windows\system32\*	Binary used to execute scripts in Windows
174	cscript.exe	c:\windows\syswow64\*	Binary used to execute scripts in Windows
175	installutil.exe	c:\windows\microsoft.net\framework\v2.0.50727\*	The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
176	installutil.exe	c:\windows\microsoft.net\framework64\v2.0.50727\*	The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
177	installutil.exe	c:\windows\microsoft.net\framework\v4.0.30319\*	The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
178	installutil.exe	c:\windows\microsoft.net\framework64\v4.0.30319\*	The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
179	esentutl.exe	c:\windows\system32\*	Binary for working with Microsoft Joint Engine Technology (JET) database
180	esentutl.exe	c:\windows\syswow64\*	Binary for working with Microsoft Joint Engine Technology (JET) database
181	hh.exe	c:\windows\*	Binary used for processing chm files in Windows
182	hh.exe	c:\windows\syswow64\*	Binary used for processing chm files in Windows
183	findstr.exe	c:\windows\system32\*	Write to ADS, discover, or download files with Findstr.exe
184	findstr.exe	c:\windows\syswow64\*	Write to ADS, discover, or download files with Findstr.exe
185	verclsid.exe	c:\windows\system32\*	Used to verify a COM object before it is instantiated by Windows Explorer
186	verclsid.exe	c:\windows\syswow64\*	Used to verify a COM object before it is instantiated by Windows Explorer
187	certreq.exe	c:\windows\system32\*	Used for requesting and managing certificates
188	certreq.exe	c:\windows\syswow64\*	Used for requesting and managing certificates
189	csc.exe	c:\windows\microsoft.net\framework\v\	Binary file used by .NET to compile C# code
190	csc.exe	c:\windows\microsoft.net\framework64\v\	Binary file used by .NET to compile C# code
191	imewdbld.exe	c:\windows\system32\ime\shared\*	Microsoft IME Open Extended Dictionary Module
192	presentationhost.exe	c:\windows\system32\*	File is used for executing Browser applications
193	presentationhost.exe	c:\windows\syswow64\*	File is used for executing Browser applications
194	shell32.dll	c:\windows\system32\*	Windows Shell Common Dll
195	shell32.dll	c:\windows\syswow64\*	Windows Shell Common Dll
196	zipfldr.dll	c:\windows\system32\*	Compressed Folder library
197	zipfldr.dll	c:\windows\syswow64\*	Compressed Folder library
198	desk.cpl	c:\windows\system32\*	Desktop Settings Control Panel
199	desk.cpl	c:\windows\syswow64\*	Desktop Settings Control Panel
200	comsvcs.dll	c:\windows\system32\*	COM+ Services
201	setupapi.dll	c:\windows\system32\*	Windows Setup Application Programming Interface
202	setupapi.dll	c:\windows\syswow64\*	Windows Setup Application Programming Interface
203	mshtml.dll	c:\windows\system32\*	Microsoft HTML Viewer
204	mshtml.dll	c:\windows\syswow64\*	Microsoft HTML Viewer
205	advpack.dll	c:\windows\system32\*	Utility for installing software and drivers with rundll32.exe
206	advpack.dll	c:\windows\syswow64\*	Utility for installing software and drivers with rundll32.exe
207	pcwutl.dll	c:\windows\system32\*	Microsoft HTML Viewer
208	pcwutl.dll	c:\windows\syswow64\*	Microsoft HTML Viewer
209	shdocvw.dll	c:\windows\system32\*	Shell Doc Object and Control Library.
210	shdocvw.dll	c:\windows\syswow64\*	Shell Doc Object and Control Library.
211	ieframe.dll	c:\windows\system32\*	Internet Browser DLL for translating HTML code.
212	ieframe.dll	c:\windows\syswow64\*	Internet Browser DLL for translating HTML code.
213	dfshim.dll	c:\windows\microsoft.net\framework\v2.0.50727\*	ClickOnce engine in Windows used by .NET
214	dfshim.dll	c:\windows\microsoft.net\framework64\v2.0.50727\*	ClickOnce engine in Windows used by .NET
215	dfshim.dll	c:\windows\microsoft.net\framework\v4.0.30319\*	ClickOnce engine in Windows used by .NET
216	dfshim.dll	c:\windows\microsoft.net\framework64\v4.0.30319\*	ClickOnce engine in Windows used by .NET
217	url.dll	c:\windows\system32\*	Internet Shortcut Shell Extension DLL.
218	url.dll	c:\windows\syswow64\*	Internet Shortcut Shell Extension DLL.
219	ieadvpack.dll	c:\windows\system32\*	INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
220	ieadvpack.dll	c:\windows\syswow64\*	INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
221	syssetup.dll	c:\windows\system32\*	Windows NT System Setup
222	syssetup.dll	c:\windows\syswow64\*	Windows NT System Setup
223	winrm.vbs	c:\windows\system32\*	Script used for manage Windows RM settings
224	winrm.vbs	c:\windows\syswow64\*	Script used for manage Windows RM settings
225	manage-bde.wsf	c:\windows\system32\*	Script for managing BitLocker
226	cl_mutexverifiers.ps1	c:\windows\diagnostics\system\windowsupdate\*	Proxy execution with CL_Mutexverifiers.ps1
227	cl_mutexverifiers.ps1	c:\windows\diagnostics\system\audio\*	Proxy execution with CL_Mutexverifiers.ps1
228	cl_mutexverifiers.ps1	c:\windows\diagnostics\system\video\*	Proxy execution with CL_Mutexverifiers.ps1
229	cl_mutexverifiers.ps1	c:\windows\diagnostics\system\speech\*	Proxy execution with CL_Mutexverifiers.ps1
230	pubprn.vbs	c:\windows\system32\printing_admin_scripts\en-us\*	Proxy execution with Pubprn.vbs
231	pubprn.vbs	c:\windows\syswow64\printing_admin_scripts\en-us\*	Proxy execution with Pubprn.vbs
232	pester.bat	c:\program files\windowspowershell\modules\pester\3.4.0\bin\*	Used as part of the Powershell pester
233	pester.bat	c:\program files\windowspowershell\modules\pester\\bin\	Used as part of the Powershell pester
234	cl_loadassembly.ps1	c:\windows\diagnostics\system\audio\*	PowerShell Diagnostic Script
235	syncappvpublishingserver.vbs	c:\windows\system32\*	Script used related to app-v and publishing server
236	cl_invocation.ps1	c:\windows\diagnostics\system\aero\*	Aero diagnostics script
237	cl_invocation.ps1	c:\windows\diagnostics\system\audio\*	Aero diagnostics script
238	cl_invocation.ps1	c:\windows\diagnostics\system\windowsupdate\*	Aero diagnostics script
239	utilityfunctions.ps1	c:\windows\diagnostics\system\networking\*	PowerShell Diagnostic Script
240	coregen.exe	c:\program files\microsoft silverlight\5.1.50918.0\*	Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight.
241	coregen.exe	c:\program files (x86)\microsoft silverlight\5.1.50918.0\*	Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight.
242	fsi.exe	c:\program files\dotnet\sdk\[sdk version]\fsharp\*	64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
243	fsi.exe	c:\program files (x86)\microsoft visual studio\2019\professional\common7\ide\commonextensions\microsoft\fsharp\*	64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
244	visualuiaverifynative.exe	c:\program files (x86)\windows kits\10\bin\[sdk version]\arm64\uiaverify\*	A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
245	visualuiaverifynative.exe	c:\program files (x86)\windows kits\10\bin\[sdk version]\x64\uiaverify\*	A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
246	visualuiaverifynative.exe	c:\program files (x86)\windows kits\10\bin\[sdk version]\uiaverify\*	A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
247	ntdsutil.exe	c:\windows\system32\*	Command line utility used to export Active Directory.
248	sqltoolsps.exe	c:\program files (x86)\microsoft sql server\130\tools\binn\*	Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.
249	dump64.exe	c:\program files (x86)\microsoft visual studio\installer\feedback\*	Memory dump tool that comes with Microsoft Visual Studio
250	wsl.exe	c:\windows\system32\*	Windows subsystem for Linux executable
251	csi.exe	c:\program files (x86)\microsoft visual studio\2017\community\msbuild\15.0\bin\roslyn\*	Command line interface included with Visual Studio.
252	csi.exe	c:\program files (x86)\microsoft web tools\packages\microsoft.net.compilers.x.y.z\tools\*	Command line interface included with Visual Studio.
253	mftrace.exe	c:\program files (x86)\windows kits\10\bin\10.0.16299.0\*	Trace log generation tool for Media Foundation Tools.
254	mftrace.exe	c:\program files (x86)\windows kits\10\bin\*	Trace log generation tool for Media Foundation Tools.
255	adplus.exe	c:\program files (x86)\windows kits\10\debuggers\x64\*	Debugging tool included with Windows Debugging Tools
256	adplus.exe	c:\program files (x86)\windows kits\10\debuggers\x86\*	Debugging tool included with Windows Debugging Tools
257	excel.exe	c:\program files\microsoft office\root\office\	Microsoft Office binary
258	excel.exe	c:\program files (x86)\microsoft office\root\office\	Microsoft Office binary
259	excel.exe	c:\program files (x86)\microsoft office 16\clientx86\root\office16\*	Microsoft Office binary
260	excel.exe	c:\program files\microsoft office 16\clientx64\root\office16\*	Microsoft Office binary
261	excel.exe	c:\program files (x86)\microsoft office\office16\*	Microsoft Office binary
262	excel.exe	c:\program files\microsoft office\office16\*	Microsoft Office binary
263	excel.exe	c:\program files (x86)\microsoft office 15\clientx86\root\office15\*	Microsoft Office binary
264	excel.exe	c:\program files\microsoft office 15\clientx64\root\office15\*	Microsoft Office binary
265	excel.exe	c:\program files (x86)\microsoft office\office15\*	Microsoft Office binary
266	excel.exe	c:\program files\microsoft office\office15\*	Microsoft Office binary
267	excel.exe	c:\program files (x86)\microsoft office 14\clientx86\root\office14\*	Microsoft Office binary
268	excel.exe	c:\program files\microsoft office 14\clientx64\root\office14\*	Microsoft Office binary
269	excel.exe	c:\program files (x86)\microsoft office\office14\*	Microsoft Office binary
270	excel.exe	c:\program files\microsoft office\office14\*	Microsoft Office binary
271	excel.exe	c:\program files (x86)\microsoft office\office12\*	Microsoft Office binary
272	excel.exe	c:\program files\microsoft office\office12\*	Microsoft Office binary
273	dotnet.exe	c:\program files\dotnet\*	dotnet.exe comes with .NET Framework
274	sqlps.exe	c:\program files (x86)\microsoft sql server\\tools\binn\	Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.
275	sqlps.exe	c:\program files\microsoft sql server\\tools\binn\	Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.
276	acccheckconsole.exe	c:\program files (x86)\windows kits\10\bin\10.0.22000.0\x86\accchecker\*	Verifies UI accessibility requirements
277	acccheckconsole.exe	c:\program files (x86)\windows kits\10\bin\10.0.22000.0\x64\accchecker\*	Verifies UI accessibility requirements
278	acccheckconsole.exe	c:\program files (x86)\windows kits\10\bin\10.0.22000.0\arm\accchecker\*	Verifies UI accessibility requirements
279	acccheckconsole.exe	c:\program files (x86)\windows kits\10\bin\10.0.22000.0\arm64\accchecker\*	Verifies UI accessibility requirements
280	powerpnt.exe	c:\program files\microsoft office\root\office\	Microsoft Office binary.
281	powerpnt.exe	c:\program files (x86)\microsoft office\root\office\	Microsoft Office binary.
282	powerpnt.exe	c:\program files (x86)\microsoft office 16\clientx86\root\office16\*	Microsoft Office binary.
283	powerpnt.exe	c:\program files\microsoft office 16\clientx64\root\office16\*	Microsoft Office binary.
284	powerpnt.exe	c:\program files (x86)\microsoft office\office16\*	Microsoft Office binary.
285	powerpnt.exe	c:\program files\microsoft office\office16\*	Microsoft Office binary.
286	powerpnt.exe	c:\program files (x86)\microsoft office 15\clientx86\root\office15\*	Microsoft Office binary.
287	powerpnt.exe	c:\program files\microsoft office 15\clientx64\root\office15\*	Microsoft Office binary.
288	powerpnt.exe	c:\program files (x86)\microsoft office\office15\*	Microsoft Office binary.
289	powerpnt.exe	c:\program files\microsoft office\office15\*	Microsoft Office binary.
290	powerpnt.exe	c:\program files (x86)\microsoft office 14\clientx86\root\office14\*	Microsoft Office binary.
291	powerpnt.exe	c:\program files\microsoft office 14\clientx64\root\office14\*	Microsoft Office binary.
292	powerpnt.exe	c:\program files (x86)\microsoft office\office14\*	Microsoft Office binary.
293	powerpnt.exe	c:\program files\microsoft office\office14\*	Microsoft Office binary.
294	powerpnt.exe	c:\program files (x86)\microsoft office\office12\*	Microsoft Office binary.
295	powerpnt.exe	c:\program files\microsoft office\office12\*	Microsoft Office binary.
296	sqldumper.exe	c:\program files\microsoft sql server\\shared\	Debugging utility included with Microsoft SQL.
297	sqldumper.exe	c:\program files (x86)\microsoft office\root\vfs\programfilesx86\microsoft analysis\as oledb\140\*	Debugging utility included with Microsoft SQL.
298	remote.exe	c:\program files (x86)\windows kits\10\debuggers\x64\*	Debugging tool included with Windows Debugging Tools
299	remote.exe	c:\program files (x86)\windows kits\10\debuggers\x86\*	Debugging tool included with Windows Debugging Tools
300	appvlp.exe	c:\program files\microsoft office\root\client\*	Application Virtualization Utility Included with Microsoft Office 2016
301	appvlp.exe	c:\program files (x86)\microsoft office\root\client\*	Application Virtualization Utility Included with Microsoft Office 2016
302	agentexecutor.exe	c:\program files (x86)\*	Intune Management Extension included on Intune Managed Devices
303	dxcap.exe	c:\windows\system32\*	DirectX diagnostics/debugger included with Visual Studio.
304	dxcap.exe	c:\windows\syswow64\*	DirectX diagnostics/debugger included with Visual Studio.
305	cdb.exe	c:\program files (x86)\windows kits\10\debuggers\x64\*	Debugging tool included with Windows Debugging Tools.
306	cdb.exe	c:\program files (x86)\windows kits\10\debuggers\x86\*	Debugging tool included with Windows Debugging Tools.
307	defaultpack.exe	c:\program files (x86)\microsoft\defaultpack\*	This binary can be downloaded along side multiple software downloads on the microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider.
308	devtoolslauncher.exe	c:\windows\system32\*	Binary will execute specified binary. Part of VS/VScode installation.
309	vsiisexelauncher.exe	c:\program files (x86)\microsoft visual studio\2019\community\common7\ide\extensions\microsoft\web tools\projectsystem\*	Binary will execute specified binary. Part of VS/VScode installation.
310	winword.exe	c:\program files\microsoft office\root\office\	Microsoft Office binary
311	winword.exe	c:\program files (x86)\microsoft office\root\office\	Microsoft Office binary
312	winword.exe	c:\program files (x86)\microsoft office 16\clientx86\root\office16\*	Microsoft Office binary
313	winword.exe	c:\program files\microsoft office 16\clientx64\root\office16\*	Microsoft Office binary
314	winword.exe	c:\program files (x86)\microsoft office\office16\*	Microsoft Office binary
315	winword.exe	c:\program files\microsoft office\office16\*	Microsoft Office binary
316	winword.exe	c:\program files (x86)\microsoft office 15\clientx86\root\office15\*	Microsoft Office binary
317	winword.exe	c:\program files\microsoft office 15\clientx64\root\office15\*	Microsoft Office binary
318	winword.exe	c:\program files (x86)\microsoft office\office15\*	Microsoft Office binary
319	winword.exe	c:\program files\microsoft office\office15\*	Microsoft Office binary
320	winword.exe	c:\program files (x86)\microsoft office 14\clientx86\root\office14\*	Microsoft Office binary
321	winword.exe	c:\program files\microsoft office 14\clientx64\root\office14\*	Microsoft Office binary
322	winword.exe	c:\program files (x86)\microsoft office\office14\*	Microsoft Office binary
323	winword.exe	c:\program files\microsoft office\office14\*	Microsoft Office binary
324	winword.exe	c:\program files (x86)\microsoft office\office12\*	Microsoft Office binary
325	winword.exe	c:\program files\microsoft office\office12\*	Microsoft Office binary
326	fsianycpu.exe	c:\program files (x86)\microsoft visual studio\2019\professional\common7\ide\commonextensions\microsoft\fsharp\*	32/64-bit FSharp (F#) Interpreter included with Visual Studio.
327	vsjitdebugger.exe	c:\windows\system32\*	Just-In-Time (JIT) debugger included with Visual Studio
328	wfc.exe	c:\program files (x86)\microsoft sdks\windows\v10.0a\bin\netfx 4.8 tools\*	The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).
329	msdeploy.exe	c:\program files (x86)\iis\microsoft web deploy v3\*	Microsoft tool used to deploy Web Applications.
330	addinutil.exe	c:\windows\microsoft.net\framework\\	.NET Tool used for updating cache files for Microsoft Office Add-Ins.
331	addinutil.exe	c:\windows\microsoft.net\framework64\\	.NET Tool used for updating cache files for Microsoft Office Add-Ins.
332	appcert.exe	c:\program files (x86)\windows kits\10\app certification kit\*	Windows App Certification Kit command-line tool.
333	appcert.exe	c:\program files\windows kits\10\app certification kit\*	Windows App Certification Kit command-line tool.
334	bginfo.exe	*	Background Information Utility included with SysInternals Suite
335	code.exe	c:\users\\appdata\local\programs\microsoft vs code\	VSCode binary, also portable (CLI) version
336	code.exe	c:\program files\microsoft vs code\*	VSCode binary, also portable (CLI) version
337	code.exe	c:\program files (x86)\microsoft vs code\*	VSCode binary, also portable (CLI) version
338	colorcpl.exe	c:\windows\system32\*	Binary that handles color management
339	colorcpl.exe	c:\windows\syswow64\*	Binary that handles color management
340	createdump.exe	c:\program files\dotnet\shared\microsoft.netcore.app\\	Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)
341	createdump.exe	c:\program files (x86)\dotnet\shared\microsoft.netcore.app\\	Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)
342	createdump.exe	c:\program files\microsoft visual studio\\community\dotnet\runtime\shared\microsoft.netcore.app\6.0.0\	Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)
343	createdump.exe	c:\program files (x86)\microsoft visual studio\\community\dotnet\runtime\shared\microsoft.netcore.app\6.0.0\	Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)
344	customshellhost.exe	c:\windows\system32\*	A host process that is used by custom shells when using Windows in Kiosk mode.
345	devicecredentialdeployment.exe	c:\windows\system32\*	Device Credential Deployment
346	devinit.exe	c:\program files\microsoft visual studio\\community\common7\tools\devinit\	Visual Studio 2019 tool
347	devinit.exe	c:\program files (x86)\microsoft visual studio\\community\common7\tools\devinit\	Visual Studio 2019 tool
348	devtunnel.exe	c:\users\\appdata\local\temp\.net\devtunnel\	Binary to enable forwarded ports on windows operating systems.
349	devtunnel.exe	c:\users\\appdata\local\temp\devtunnels\	Binary to enable forwarded ports on windows operating systems.
350	dnx.exe	*	.Net Execution environment file included with .Net.
351	dsdbutil.exe	c:\windows\system32\*	Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.
352	dsdbutil.exe	c:\windows\syswow64\*	Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.
353	dumpminitool.exe	c:\program files\microsoft visual studio\2022\community\common7\ide\extensions\testplatform\extensions\*	Dump tool part Visual Studio 2022
354	fsutil.exe	c:\windows\system32\*	File System Utility
355	fsutil.exe	c:\windows\syswow64\*	File System Utility
356	iediagcmd.exe	c:\program files\internet explorer\*	Diagnostics Utility for Internet Explorer
357	launch-vsdevshell.ps1	c:\program files (x86)\microsoft visual studio\2019\community\common7\tools\*	Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet
358	launch-vsdevshell.ps1	c:\program files\microsoft visual studio\2022\community\common7\tools\*	Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet
359	ldifde.exe	c:\windows\system32\*	Creates, modifies, and deletes LDAP directory objects.
360	ldifde.exe	c:\windows\syswow64\*	Creates, modifies, and deletes LDAP directory objects.
361	microsoft.nodejstools.pressanykey.exe	c:\program files\microsoft visual studio\\community\common7\ide\extensions\microsoft\nodejstools\nodejstools\	Part of the NodeJS Visual Studio tools.
362	microsoft.nodejstools.pressanykey.exe	c:\program files (x86)\microsoft visual studio\\community\common7\ide\extensions\microsoft\nodejstools\nodejstools\	Part of the NodeJS Visual Studio tools.
363	msaccess.exe	c:\program files\microsoft office\root\office\	Microsoft Office component
364	msaccess.exe	c:\program files (x86)\microsoft office\root\office\	Microsoft Office component
365	msaccess.exe	c:\program files (x86)\microsoft office 16\clientx86\root\office16\*	Microsoft Office component
366	msaccess.exe	c:\program files\microsoft office 16\clientx64\root\office16\*	Microsoft Office component
367	msaccess.exe	c:\program files (x86)\microsoft office\office16\*	Microsoft Office component
368	msaccess.exe	c:\program files\microsoft office\office16\*	Microsoft Office component
369	msaccess.exe	c:\program files (x86)\microsoft office 15\clientx86\root\office15\*	Microsoft Office component
370	msaccess.exe	c:\program files\microsoft office 15\clientx64\root\office15\*	Microsoft Office component
371	msaccess.exe	c:\program files (x86)\microsoft office\office15\*	Microsoft Office component
372	msaccess.exe	c:\program files\microsoft office\office15\*	Microsoft Office component
373	msaccess.exe	c:\program files (x86)\microsoft office 14\clientx86\root\office14\*	Microsoft Office component
374	msaccess.exe	c:\program files\microsoft office 14\clientx64\root\office14\*	Microsoft Office component
375	msaccess.exe	c:\program files (x86)\microsoft office\office14\*	Microsoft Office component
376	msaccess.exe	c:\program files\microsoft office\office14\*	Microsoft Office component
377	msaccess.exe	c:\program files (x86)\microsoft office\office12\*	Microsoft Office component
378	msaccess.exe	c:\program files\microsoft office\office12\*	Microsoft Office component
379	msedge.exe	c:\users\\appdata\local\microsoft\edge\	Microsoft Edge browser
380	msedge.exe	c:\program files\microsoft\edge\application\*	Microsoft Edge browser
381	msedge.exe	c:\program files (x86)\microsoft\edge\application\*	Microsoft Edge browser
382	msedgewebview2.exe	c:\program files (x86)\microsoft\edge\application\*	msedgewebview2.exe is the executable file for Microsoft Edge WebView2, which is a web browser control used by applications to display web content.
383	msedge_proxy.exe	c:\\program files (x86)\microsoft\edge\application\*	Microsoft Edge Browser
384	msohtmed.exe	c:\program files\microsoft office\root\office\	Microsoft Office component
385	msohtmed.exe	c:\program files (x86)\microsoft office\root\office\	Microsoft Office component
386	msohtmed.exe	c:\program files (x86)\microsoft office 16\clientx86\root\office16\*	Microsoft Office component
387	msohtmed.exe	c:\program files\microsoft office 16\clientx64\root\office16\*	Microsoft Office component
388	msohtmed.exe	c:\program files (x86)\microsoft office\office16\*	Microsoft Office component
389	msohtmed.exe	c:\program files\microsoft office\office16\*	Microsoft Office component
390	msohtmed.exe	c:\program files (x86)\microsoft office 15\clientx86\root\office15\*	Microsoft Office component
391	msohtmed.exe	c:\program files\microsoft office 15\clientx64\root\office15\*	Microsoft Office component
392	msohtmed.exe	c:\program files (x86)\microsoft office\office15\*	Microsoft Office component
393	msohtmed.exe	c:\program files\microsoft office\office15\*	Microsoft Office component
394	msohtmed.exe	c:\program files (x86)\microsoft office 14\clientx86\root\office14\*	Microsoft Office component
395	msohtmed.exe	c:\program files\microsoft office 14\clientx64\root\office14\*	Microsoft Office component
396	msohtmed.exe	c:\program files (x86)\microsoft office\office14\*	Microsoft Office component
397	msohtmed.exe	c:\program files\microsoft office\office14\*	Microsoft Office component
398	msohtmed.exe	c:\program files (x86)\microsoft office\office12\*	Microsoft Office component
399	msohtmed.exe	c:\program files\microsoft office\office12\*	Microsoft Office component
400	mspub.exe	c:\program files\microsoft office\root\office\	Microsoft Publisher
401	mspub.exe	c:\program files (x86)\microsoft office\root\office\	Microsoft Publisher
402	mspub.exe	c:\program files (x86)\microsoft office 16\clientx86\root\office16\*	Microsoft Publisher
403	mspub.exe	c:\program files\microsoft office 16\clientx64\root\office16\*	Microsoft Publisher
404	mspub.exe	c:\program files (x86)\microsoft office\office16\*	Microsoft Publisher
405	mspub.exe	c:\program files\microsoft office\office16\*	Microsoft Publisher
406	mspub.exe	c:\program files (x86)\microsoft office 15\clientx86\root\office15\*	Microsoft Publisher
407	mspub.exe	c:\program files\microsoft office 15\clientx64\root\office15\*	Microsoft Publisher
408	mspub.exe	c:\program files (x86)\microsoft office\office15\*	Microsoft Publisher
409	mspub.exe	c:\program files\microsoft office\office15\*	Microsoft Publisher
410	mspub.exe	c:\program files (x86)\microsoft office 14\clientx86\root\office14\*	Microsoft Publisher
411	mspub.exe	c:\program files\microsoft office 14\clientx64\root\office14\*	Microsoft Publisher
412	mspub.exe	c:\program files (x86)\microsoft office\office14\*	Microsoft Publisher
413	mspub.exe	c:\program files\microsoft office\office14\*	Microsoft Publisher
414	msxsl.exe	*	Command line utility used to perform XSL transformations.
415	onedrivestandaloneupdater.exe	c:\users\\appdata\local\microsoft\onedrive\	OneDrive Standalone Updater
416	openconsole.exe	c:\program files (x86)\microsoft visual studio\2019\community\common7\ide\commonextensions\microsoft\terminal\servicehub\os64\*	Console Window host for Windows Terminal
417	openconsole.exe	c:\program files (x86)\microsoft visual studio\2019\community\common7\ide\commonextensions\microsoft\terminal\servicehub\os86\*	Console Window host for Windows Terminal
418	openconsole.exe	c:\program files\microsoft visual studio\2022\community\common7\ide\commonextensions\microsoft\terminal\servicehub\os64\*	Console Window host for Windows Terminal
419	procdump.exe	*	SysInternals Memory Dump Tool
420	protocolhandler.exe	c:\program files\microsoft office\root\office\	Microsoft Office binary
421	protocolhandler.exe	c:\program files (x86)\microsoft office\root\office\	Microsoft Office binary
422	protocolhandler.exe	c:\program files (x86)\microsoft office 16\clientx86\root\office16\*	Microsoft Office binary
423	protocolhandler.exe	c:\program files\microsoft office 16\clientx64\root\office16\*	Microsoft Office binary
424	protocolhandler.exe	c:\program files (x86)\microsoft office\office16\*	Microsoft Office binary
425	protocolhandler.exe	c:\program files\microsoft office\office16\*	Microsoft Office binary
426	protocolhandler.exe	c:\program files (x86)\microsoft office 15\clientx86\root\office15\*	Microsoft Office binary
427	protocolhandler.exe	c:\program files\microsoft office 15\clientx64\root\office15\*	Microsoft Office binary
428	protocolhandler.exe	c:\program files (x86)\microsoft office\office15\*	Microsoft Office binary
429	protocolhandler.exe	c:\program files\microsoft office\office15\*	Microsoft Office binary
430	provlaunch.exe	c:\windows\system32\*	Launcher process
431	rcsi.exe	*	Non-Interactive command line inerface included with Visual Studio.
432	runexehelper.exe	c:\windows\system32\*	Launcher process
433	scrobj.dll	c:\windows\system32\*	Windows Script Component Runtime
434	scrobj.dll	c:\windows\syswow64\*	Windows Script Component Runtime
435	setres.exe	c:\windows\system32\*	Configures display settings
436	shimgvw.dll	c:\windows\system32\*	Photo Gallery Viewer
437	shimgvw.dll	c:\windows\syswow64\*	Photo Gallery Viewer
438	squirrel.exe	c:\users\\appdata\local\microsoft\teams\current\	Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
439	squirrel.exe	c:\users\\appdata\local\microsoft\teams\stage\	Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
440	squirrel.exe	c:\programdata\\microsoft\teams\current\	Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
441	ssh.exe	c:\windows\system32\openssh\*	Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.
442	tar.exe	c:\windows\system32\*	Used by Windows to extract and create archives.
443	tar.exe	c:\windows\syswow64\*	Used by Windows to extract and create archives.
444	te.exe	*	Testing tool included with Microsoft Test Authoring and Execution Framework (TAEF).
445	teams.exe	c:\users\\appdata\local\microsoft\teams\current\	Electron runtime binary which runs the Teams application
446	teams.exe	c:\users\\appdata\local\microsoft\teams\stage\	Electron runtime binary which runs the Teams application
447	teams.exe	c:\programdata\\microsoft\teams\current\	Electron runtime binary which runs the Teams application
448	testwindowremoteagent.exe	c:\program files\microsoft visual studio\2022\community\common7\ide\commonextensions\microsoft\testwindow\remoteagent\*	TestWindowRemoteAgent.exe is the command-line tool to establish RPC
449	tracker.exe	*	Tool included with Microsoft .Net Framework.
450	unregmp2.exe	c:\windows\system32\*	Microsoft Windows Media Player Setup Utility
451	unregmp2.exe	c:\windows\syswow64\*	Microsoft Windows Media Player Setup Utility
452	update.exe	c:\users\\appdata\local\microsoft\teams\	Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
453	update.exe	c:\users\\appdata\local\squirreltemp\	Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
454	update.exe	c:\programdata\\microsoft\teams\	Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
455	vsdiagnostics.exe	c:\program files\microsoft visual studio\2022\community\team tools\diagnosticshub\collector\*	Command-line tool used for performing diagnostics.
456	vshadow.exe	c:\program files (x86)\windows kits\10\bin\10.0.xxxxx.0\x64\*	VShadow is a command-line tool that can be used to create and manage volume shadow copies.
457	vsls-agent.exe	c:\program files (x86)\microsoft visual studio\2019\professional\common7\ide\extensions\microsoft\liveshare\agent\*	Agent for Visual Studio Live Share (Code Collaboration)
458	vstest.console.exe	c:\program files\microsoft visual studio\2022\community\common7\ide\commonextensions\microsoft\testwindow\*	VSTest.Console.exe is the command-line tool to run tests
459	vstest.console.exe	c:\program files (x86)\microsoft visual studio\2022\testagent\common7\ide\commonextensions\microsoft\testwindow\*	VSTest.Console.exe is the command-line tool to run tests
460	wbadmin.exe	c:\windows\system32\*	Windows Backup Administration utility
461	winget.exe	c:\users\\appdata\local\microsoft\windowsapps\	Windows Package Manager tool
462	winproj.exe	c:\program files\microsoft office\root\office\	Microsoft Project Executable
463	winproj.exe	c:\program files (x86)\microsoft office\root\office\	Microsoft Project Executable
464	winproj.exe	c:\program files (x86)\microsoft office\office14\*	Microsoft Project Executable
465	winproj.exe	c:\program files\microsoft office\office14\*	Microsoft Project Executable
466	winproj.exe	c:\program files (x86)\microsoft office\office15\*	Microsoft Project Executable
467	winproj.exe	c:\program files\microsoft office\office15\*	Microsoft Project Executable
468	winproj.exe	c:\program files (x86)\microsoft office\office16\*	Microsoft Project Executable
469	winproj.exe	c:\program files\microsoft office\office16\*	Microsoft Project Executable
470	winproj.exe	c:\program files (x86)\microsoft office\root\office14\*	Microsoft Project Executable
471	winproj.exe	c:\program files\microsoft office\root\office14\*	Microsoft Project Executable
472	winproj.exe	c:\program files (x86)\microsoft office\root\office15\*	Microsoft Project Executable
473	winproj.exe	c:\program files\microsoft office\root\office15\*	Microsoft Project Executable
474	winproj.exe	c:\program files (x86)\microsoft office\root\office16\*	Microsoft Project Executable
475	winproj.exe	c:\program files\microsoft office\root\office16\*	Microsoft Project Executable
476	wt.exe	c:\program files\windowsapps\microsoft.windowsterminal_*	Windows Terminal

50 KiB Raw Permalink Blame History

50 KiB

Raw Permalink Blame History