splunk-security_content/lookups/csv/lolbas_file_path.csv

1	lolbas_file_name	lolbas_file_path	description
2	acccheckconsole.exe	C:\Program Files (x86)\Windows Kits\*	Verifies UI accessibility requirements
3	addinutil.exe	C:\Windows\Microsoft.NET\Framework\*	.NET Tool used for updating cache files for Microsoft Office Add-Ins.
4	adplus.exe	C:\Program Files (x86)\Windows Kits\*	Debugging tool included with Windows Debugging Tools
5	agentexecutor.exe	C:\Program Files (x86)\Microsoft Intune Management Extension\*	Intune Management Extension included on Intune Managed Devices
6	appcert.exe	C:\Program Files (x86)\Windows Kits\*	Windows App Certification Kit command-line tool.
7	appcert.exe	C:\Program Files\Windows Kits\*	Windows App Certification Kit command-line tool.
8	appinstaller.exe	C:\Program Files\WindowsApps\microsoft.desktopappinstaller*	Tool used for installation of AppX/MSIX applications on Windows 10
9	appvlp.exe	C:\Program Files (x86)\Microsoft Office*	Application Virtualization Utility Included with Microsoft Office 2016
10	appvlp.exe	C:\Program Files\Microsoft Office*	Application Virtualization Utility Included with Microsoft Office 2016
11	aspnet_compiler.exe	C:\Windows\Microsoft.NET\Framework\*	ASP.NET Compilation Tool
12	aspnet_compiler.exe	C:\Windows\Microsoft.NET\Framework64\*	ASP.NET Compilation Tool
13	at.exe	C:\Windows\System32\*	Schedule periodic tasks
14	at.exe	C:\Windows\SysWOW64\*	Schedule periodic tasks
15	atbroker.exe	C:\Windows\System32\*	Helper binary for Assistive Technology (AT)
16	atbroker.exe	C:\Windows\SysWOW64\*	Helper binary for Assistive Technology (AT)
17	bitsadmin.exe	C:\Windows\System32\*	Used for managing background intelligent transfer
18	bitsadmin.exe	C:\Windows\SysWOW64\*	Used for managing background intelligent transfer
19	cdb.exe	C:\Program Files (x86)\Windows Kits\*	Debugging tool included with Windows Debugging Tools.
20	certoc.exe	C:\Windows\System32\*	Used for installing certificates
21	certoc.exe	C:\Windows\SysWOW64\*	Used for installing certificates
22	certreq.exe	C:\Windows\System32\*	Used for requesting and managing certificates
23	certreq.exe	C:\Windows\SysWOW64\*	Used for requesting and managing certificates
24	certutil.exe	C:\Windows\System32\*	Windows binary used for handling certificates
25	certutil.exe	C:\Windows\SysWOW64\*	Windows binary used for handling certificates
26	cmd.exe	C:\Windows\System32\*	The command-line interpreter in Windows
27	cmd.exe	C:\Windows\SysWOW64\*	The command-line interpreter in Windows
28	cmdkey.exe	C:\Windows\System32\*	creates, lists, and deletes stored user names and passwords or credentials.
29	cmdkey.exe	C:\Windows\SysWOW64\*	creates, lists, and deletes stored user names and passwords or credentials.
30	cmdl32.exe	C:\Windows\System32\*	Microsoft Connection Manager Auto-Download
31	cmdl32.exe	C:\Windows\SysWOW64\*	Microsoft Connection Manager Auto-Download
32	cmstp.exe	C:\Windows\System32\*	Installs or removes a Connection Manager service profile.
33	cmstp.exe	C:\Windows\SysWOW64\*	Installs or removes a Connection Manager service profile.
34	colorcpl.exe	C:\Windows\System32\*	Binary that handles color management
35	colorcpl.exe	C:\Windows\SysWOW64\*	Binary that handles color management
36	conhost.exe	C:\Windows\System32\*	Console Window host
37	control.exe	C:\Windows\SysWOW64\*	Console Window host
38	csc.exe	C:\Program Files\Microsoft Visual Studio\*	Binary file used by .NET to compile C# code
39	csc.exe	C:\Windows\Microsoft.NET\Framework\*	Binary file used by .NET to compile C# code
40	csc.exe	C:\Windows\Microsoft.NET\Framework64\*	Binary file used by .NET to compile C# code
41	cscript.exe	C:\Windows\System32\*	Binary used to execute scripts in Windows
42	cscript.exe	C:\Windows\SysWOW64\*	Binary used to execute scripts in Windows
43	csi.exe	C:\Program Files (x86)\Microsoft Visual Studio\*	Command line interface included with Visual Studio.
44	csi.exe	C:\Program Files (x86)\Microsoft Web Tools\*	Command line interface included with Visual Studio.
45	customshellhost.exe	C:\Windows\System32\*	A host process that is used by custom shells when using Windows in Kiosk mode.
46	datasvcutil.exe	C:\Windows\Microsoft.NET\Framework\*	DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application.
47	datasvcutil.exe	C:\Windows\Microsoft.NET\Framework64\*	DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application.
48	desktopimgdownldr.exe	C:\Windows\System32\*	Windows binary used to configure lockscreen/desktop image
49	devicecredentialdeployment.exe	C:\Windows\System32\*	Device Credential Deployment
50	devinit.exe	C:\Program Files (x86)\Microsoft Visual Studio\*	Visual Studio 2019 tool
51	devinit.exe	C:\Program Files\Microsoft Visual Studio\*	Visual Studio 2019 tool
52	devtoolslauncher.exe	C:\Windows\System32\*	Binary will execute specified binary. Part of VS/VScode installation.
53	dfsvc.exe	C:\Windows\Microsoft.NET\Framework\*	ClickOnce engine in Windows used by .NET
54	dfsvc.exe	C:\Windows\Microsoft.NET\Framework64\*	ClickOnce engine in Windows used by .NET
55	diantz.exe	C:\Windows\System32\*	Binary that package existing files into a cabinet (.cab) file
56	diantz.exe	C:\Windows\SysWOW64\*	Binary that package existing files into a cabinet (.cab) file
57	diskshadow.exe	C:\Windows\System32\*	Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
58	diskshadow.exe	C:\Windows\SysWOW64\*	Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
59	dnscmd.exe	C:\Windows\System32\*	A command-line interface for managing DNS servers
60	dnscmd.exe	C:\Windows\SysWOW64\*	A command-line interface for managing DNS servers
61	dotnet.exe	C:\Program Files (x86)\dotnet\*	dotnet.exe comes with .NET Framework
62	dotnet.exe	C:\Program Files\dotnet\*	dotnet.exe comes with .NET Framework
63	dotnet.exe	C:\Program Files\Microsoft Visual Studio\*	dotnet.exe comes with .NET Framework
64	dsdbutil.exe	C:\Windows\System32\*	Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.
65	dsdbutil.exe	C:\Windows\SysWOW64\*	Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.
66	dumpminitool.exe	C:\Program Files (x86)\Microsoft Visual Studio\*	Dump tool part Visual Studio 2022
67	dumpminitool.exe	C:\Program Files\dotnet\*	Dump tool part Visual Studio 2022
68	dumpminitool.exe	C:\Program Files\Microsoft Visual Studio\*	Dump tool part Visual Studio 2022
69	dxcap.exe	C:\Windows\System32\*	DirectX diagnostics/debugger included with Visual Studio.
70	dxcap.exe	C:\Windows\SysWOW64\*	DirectX diagnostics/debugger included with Visual Studio.
71	esentutl.exe	C:\Windows\System32\*	Binary for working with Microsoft Joint Engine Technology (JET) database
72	esentutl.exe	C:\Windows\SysWOW64\*	Binary for working with Microsoft Joint Engine Technology (JET) database
73	eventvwr.exe	C:\Windows\System32\*	Displays Windows Event Logs in a GUI window.
74	eventvwr.exe	C:\Windows\SysWOW64\*	Displays Windows Event Logs in a GUI window.
75	excel.exe	C:\Program Files (x86)\Microsoft Office*	Microsoft Office binary
76	excel.exe	C:\Program Files\Microsoft Office*	Microsoft Office binary
77	expand.exe	C:\Windows\System32\*	Binary that expands one or more compressed files
78	expand.exe	C:\Windows\SysWOW64\*	Binary that expands one or more compressed files
79	explorer.exe	C:\windows\*	Binary used for managing files and system components within Windows
80	explorer.exe	C:\Windows\SysWOW64\*	Binary used for managing files and system components within Windows
81	extexport.exe	C:\Program Files (x86)\Internet Explorer\*	Load a DLL located in the C:\test folder with a specific name.
82	extexport.exe	C:\Program Files\Internet Explorer\*	Load a DLL located in the C:\test folder with a specific name.
83	extrac32.exe	C:\Windows\System32\*	Extract to ADS, copy or overwrite a file with Extrac32.exe
84	extrac32.exe	C:\Windows\SysWOW64\*	Extract to ADS, copy or overwrite a file with Extrac32.exe
85	findstr.exe	C:\Windows\System32\*	Write to ADS, discover, or download files with Findstr.exe
86	findstr.exe	C:\Windows\SysWOW64\*	Write to ADS, discover, or download files with Findstr.exe
87	finger.exe	C:\Windows\System32\*	Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
88	finger.exe	C:\Windows\SysWOW64\*	Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
89	fltmc.exe	C:\Windows\System32\*	Filter Manager Control Program used by Windows
90	forfiles.exe	C:\Windows\System32\*	Selects and executes a command on a file or set of files. This command is useful for batch processing.
91	forfiles.exe	C:\Windows\SysWOW64\*	Selects and executes a command on a file or set of files. This command is useful for batch processing.
92	fsi.exe	C:\Program Files (x86)\Microsoft Visual Studio\*	64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
93	fsi.exe	C:\Program Files\dotnet\*	64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
94	fsi.exe	C:\Program Files\Microsoft Visual Studio\*	64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
95	fsianycpu.exe	C:\Program Files (x86)\Microsoft Visual Studio\*	32/64-bit FSharp (F#) Interpreter included with Visual Studio.
96	fsutil.exe	C:\Windows\System32\*	File System Utility
97	fsutil.exe	C:\Windows\SysWOW64\*	File System Utility
98	ftp.exe	C:\Windows\System32\*	A binary designed for connecting to FTP servers
99	ftp.exe	C:\Windows\SysWOW64\*	A binary designed for connecting to FTP servers
100	gfxdownloadwrapper.exe	C:\Windows\System32\DriverStore\FileRepository\*	Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path.
101	gpscript.exe	C:\Windows\System32\*	Used by group policy to process scripts
102	gpscript.exe	C:\Windows\SysWOW64\*	Used by group policy to process scripts
103	hh.exe	C:\windows\*	Binary used for processing chm files in Windows
104	hh.exe	C:\Windows\SysWOW64\*	Binary used for processing chm files in Windows
105	ie4uinit.exe	C:\Windows\System32\*	Executes commands from a specially prepared ie4uinit.inf file.
106	ie4uinit.exe	C:\Windows\SysWOW64\*	Executes commands from a specially prepared ie4uinit.inf file.
107	iediagcmd.exe	C:\Program Files\internet explorer\*	Diagnostics Utility for Internet Explorer
108	ieexec.exe	C:\windows\Microsoft.NET\Framework\*	The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
109	ieexec.exe	C:\windows\Microsoft.NET\Framework64\*	The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
110	ilasm.exe	C:\windows\Microsoft.NET\Framework\*	used for compile c# code into dll or exe.
111	ilasm.exe	C:\windows\Microsoft.NET\Framework64\*	used for compile c# code into dll or exe.
112	imewdbld.exe	C:\Windows\System32\ime\shared\*	Microsoft IME Open Extended Dictionary Module
113	infdefaultinstall.exe	C:\Windows\System32\*	Binary used to perform installation based on content inside inf files
114	infdefaultinstall.exe	C:\Windows\SysWOW64\*	Binary used to perform installation based on content inside inf files
115	installutil.exe	C:\windows\Microsoft.NET\Framework\*	The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
116	installutil.exe	C:\windows\Microsoft.NET\Framework64\*	The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
117	jsc.exe	C:\windows\Microsoft.NET\Framework\*	Binary file used by .NET to compile javascript code to .exe or .dll format
118	jsc.exe	C:\windows\Microsoft.NET\Framework64\*	Binary file used by .NET to compile javascript code to .exe or .dll format
119	ldifde.exe	C:\Windows\System32\*	Creates, modifies, and deletes LDAP directory objects.
120	ldifde.exe	C:\Windows\SysWOW64\*	Creates, modifies, and deletes LDAP directory objects.
121	makecab.exe	C:\Windows\System32\*	Binary to package existing files into a cabinet (.cab) file
122	makecab.exe	C:\Windows\SysWOW64\*	Binary to package existing files into a cabinet (.cab) file
123	manage-bde.wsf	C:\Windows\System32\*	Script for managing BitLocker
124	mavinject.exe	C:\Windows\System32\*	Used by App-v in Windows
125	mavinject.exe	C:\Windows\SysWOW64\*	Used by App-v in Windows
126	mftrace.exe	C:\Program Files (x86)\windows kits\*	Trace log generation tool for Media Foundation Tools.
127	microsoft.nodejstools.pressanykey.exe	C:\Program Files (x86)\Microsoft Visual Studio\*	Part of the NodeJS Visual Studio tools.
128	microsoft.nodejstools.pressanykey.exe	C:\Program Files\Microsoft Visual Studio\*	Part of the NodeJS Visual Studio tools.
129	microsoft.workflow.compiler.exe	C:\windows\Microsoft.NET\Framework64\*	A utility included with .NET that is capable of compiling and executing C# or VB.net code.
130	mmc.exe	C:\Windows\System32\*	Load snap-ins to locally and remotely manage Windows systems
131	mmc.exe	C:\Windows\SysWOW64\*	Load snap-ins to locally and remotely manage Windows systems
132	msaccess.exe	C:\Program Files (x86)\Microsoft Office*	Microsoft Office binary
133	msaccess.exe	C:\Program Files\Microsoft Office*	Microsoft Office binary
134	msbuild.exe	C:\Program Files (x86)\msbuild\14.0\bin\*	Used to compile and execute code
135	msbuild.exe	C:\windows\Microsoft.NET\Framework\*	Used to compile and execute code
136	msbuild.exe	C:\windows\Microsoft.NET\Framework64\*	Used to compile and execute code
137	msconfig.exe	C:\Windows\System32\*	MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows
138	msdeploy.exe	C:\Program Files (x86)\iis\microsoft web deploy v3\*	Microsoft tool used to deploy Web Applications.
139	msdt.exe	C:\Windows\System32\*	Microsoft diagnostics tool
140	msdt.exe	C:\Windows\SysWOW64\*	Microsoft diagnostics tool
141	mshta.exe	C:\Windows\System32\*	Used by Windows to execute html applications. (.hta)
142	mshta.exe	C:\Windows\SysWOW64\*	Used by Windows to execute html applications. (.hta)
143	msiexec.exe	C:\Windows\System32\*	Used by Windows to execute msi files
144	msiexec.exe	C:\Windows\SysWOW64\*	Used by Windows to execute msi files
145	msohtmed.exe	C:\Program Files (x86)\Microsoft Office*	Microsoft Office binary
146	msohtmed.exe	C:\Program Files\Microsoft Office*	Microsoft Office binary
147	mspub.exe	C:\Program Files (x86)\Microsoft Office*	Microsoft Office binary
148	mspub.exe	C:\Program Files\Microsoft Office*	Microsoft Office binary
149	netsh.exe	C:\Windows\System32\*	Netsh is a Windows tool used to manipulate network interface settings.
150	netsh.exe	C:\Windows\SysWOW64\*	Netsh is a Windows tool used to manipulate network interface settings.
151	ntdsutil.exe	C:\Windows\System32\*	Command line utility used to export Active Directory.
152	odbcconf.exe	C:\Windows\System32\*	Used in Windows for managing ODBC connections
153	odbcconf.exe	C:\Windows\SysWOW64\*	Used in Windows for managing ODBC connections
154	offlinescannershell.exe	C:\Program Files\windows defender\offline\*	Windows Defender Offline Shell
155	pcalua.exe	C:\Windows\System32\*	Program Compatibility Assistant
156	pcwrun.exe	C:\Windows\System32\*	Program Compatibility Wizard
157	pktmon.exe	C:\Windows\System32\*	Capture Network Packets on the windows 10 with October 2018 Update or later.
158	pktmon.exe	C:\Windows\SysWOW64\*	Capture Network Packets on the windows 10 with October 2018 Update or later.
159	pnputil.exe	C:\Windows\System32\*	Used for installing drivers
160	powerpnt.exe	C:\Program Files (x86)\Microsoft Office*	Microsoft Office binary
161	powerpnt.exe	C:\Program Files\Microsoft Office*	Microsoft Office binary
162	presentationhost.exe	C:\Windows\System32\*	File is used for executing Browser applications
163	presentationhost.exe	C:\Windows\SysWOW64\*	File is used for executing Browser applications
164	print.exe	C:\Windows\System32\*	Used by Windows to send files to the printer
165	print.exe	C:\Windows\SysWOW64\*	Used by Windows to send files to the printer
166	printbrm.exe	C:\Windows\System32\spool\tools\*	Printer Migration Command-Line Tool
167	protocolhandler.exe	C:\Program Files (x86)\Microsoft Office*	Microsoft Office binary
168	protocolhandler.exe	C:\Program Files\Microsoft Office*	Microsoft Office binary
169	provlaunch.exe	C:\Windows\System32\*	Launcher process
170	psr.exe	C:\Windows\System32\*	Windows Problem Steps Recorder, used to record screen and clicks.
171	psr.exe	C:\Windows\SysWOW64\*	Windows Problem Steps Recorder, used to record screen and clicks.
172	rasautou.exe	C:\Windows\System32\*	Windows Remote Access Dialer
173	rdrleakdiag.exe	C:\Windows\System32\*	Microsoft Windows resource leak diagnostic tool
174	rdrleakdiag.exe	C:\Windows\SysWOW64\*	Microsoft Windows resource leak diagnostic tool
175	reg.exe	C:\Windows\System32\*	Used to manipulate the registry
176	reg.exe	C:\Windows\SysWOW64\*	Used to manipulate the registry
177	regasm.exe	C:\windows\Microsoft.NET\Framework\v2.0.50727\*	Part of .NET
178	regasm.exe	C:\windows\Microsoft.NET\Framework\v4.0.30319\*	Part of .NET
179	regasm.exe	C:\windows\Microsoft.NET\Framework64\v2.0.50727\*	Part of .NET
180	regasm.exe	C:\windows\Microsoft.NET\Framework64\v4.0.30319\*	Part of .NET
181	regedit.exe	C:\windows\*	Used by Windows to manipulate registry
182	regedit.exe	C:\Windows\SysWOW64\*	Used by Windows to manipulate registry
183	regini.exe	C:\Windows\System32\*	Used to manipulate the registry
184	regini.exe	C:\Windows\SysWOW64\*	Used to manipulate the registry
185	register-cimprovider.exe	C:\Windows\System32\*	Used to register new wmi providers
186	register-cimprovider.exe	C:\Windows\SysWOW64\*	Used to register new wmi providers
187	regsvcs.exe	C:\Windows\Microsoft.NET\Framework\*	Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
188	regsvcs.exe	C:\Windows\Microsoft.NET\Framework64\*	Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
189	regsvr32.exe	C:\Windows\System32\*	Used by Windows to register dlls
190	regsvr32.exe	C:\Windows\SysWOW64\*	Used by Windows to register dlls
191	replace.exe	C:\Windows\System32\*	Used to replace file with another file
192	replace.exe	C:\Windows\SysWOW64\*	Used to replace file with another file
193	rpcping.exe	C:\Windows\System32\*	Used to verify rpc connection
194	rpcping.exe	C:\Windows\SysWOW64\*	Used to verify rpc connection
195	rundll32.exe	C:\Windows\System32\*	Used by Windows to execute dll files
196	rundll32.exe	C:\Windows\SysWOW64\*	Used by Windows to execute dll files
197	runexehelper.exe	C:\Windows\System32\*	Launcher process
198	runonce.exe	C:\Windows\System32\*	Executes a Run Once Task that has been configured in the registry
199	runonce.exe	C:\Windows\SysWOW64\*	Executes a Run Once Task that has been configured in the registry
200	sc.exe	C:\Windows\System32\*	Used by Windows to manage services
201	sc.exe	C:\Windows\SysWOW64\*	Used by Windows to manage services
202	schtasks.exe	C:\Windows\System32\*	Schedule periodic tasks
203	schtasks.exe	C:\Windows\SysWOW64\*	Schedule periodic tasks
204	scriptrunner.exe	C:\Windows\System32\*	Execute binary through proxy binary to evade defensive counter measures
205	scriptrunner.exe	C:\Windows\SysWOW64\*	Execute binary through proxy binary to evade defensive counter measures
206	setres.exe	C:\Windows\System32\*	Configures display settings
207	settingsynchost.exe	C:\Windows\System32\*	Host Process for Setting Synchronization
208	settingsynchost.exe	C:\Windows\SysWOW64\*	Host Process for Setting Synchronization
209	sqldumper.exe	C:\Program Files\microsoft office\root\vfs\*	Debugging utility included with Microsoft SQL.
210	sqldumper.exe	C:\Program Files\Microsoft SQL Server\*	Debugging utility included with Microsoft SQL.
211	sqlps.exe	C:\Program Files (x86)\Microsoft SQL Server\*	Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.
212	sqlps.exe	C:\Program Files\Microsoft SQL Server\*	Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.
213	sqltoolsps.exe	C:\Program Files (x86)\Microsoft SQL Server\*	Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.
214	stordiag.exe	C:\Windows\System32\*	Storage diagnostic tool
215	stordiag.exe	C:\Windows\SysWOW64\*	Storage diagnostic tool
216	syncappvpublishingserver.exe	C:\Windows\System32\*	Used by App-v to get App-v server lists
217	syncappvpublishingserver.exe	C:\Windows\SysWOW64\*	Used by App-v to get App-v server lists
218	tar.exe	C:\Windows\System32\*	Used by Windows to extract and create archives.
219	tar.exe	C:\Windows\SysWOW64\*	Used by Windows to extract and create archives.
220	testwindowremoteagent.exe	C:\Program Files\Microsoft Visual Studio\*	TestWindowRemoteAgent.exe is the command-line tool to establish RPC
221	ttdinject.exe	C:\Windows\System32\*	Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
222	ttdinject.exe	C:\Windows\SysWOW64\*	Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
223	tttracer.exe	C:\Windows\System32\*	Used by Windows 1809 and newer to Debug Time Travel
224	tttracer.exe	C:\Windows\SysWOW64\*	Used by Windows 1809 and newer to Debug Time Travel
225	unregmp2.exe	C:\Windows\System32\*	Microsoft Windows Media Player Setup Utility
226	unregmp2.exe	C:\Windows\SysWOW64\*	Microsoft Windows Media Player Setup Utility
227	vbc.exe	C:\Windows\Microsoft.NET\Framework\*	Binary file used for compile vbs code
228	vbc.exe	C:\Windows\Microsoft.NET\Framework64\*	Binary file used for compile vbs code
229	verclsid.exe	C:\Windows\System32\*	Used to verify a COM object before it is instantiated by Windows Explorer
230	verclsid.exe	C:\Windows\SysWOW64\*	Used to verify a COM object before it is instantiated by Windows Explorer
231	visualuiaverifynative.exe	C:\Program Files (x86)\Windows Kits\*	A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
232	vsdiagnostics.exe	C:\Program Files\Microsoft Visual Studio\*	Command-line tool used for performing diagnostics.
233	vshadow.exe	C:\Program Files (x86)\Windows Kits\*	VShadow is a command-line tool that can be used to create and manage volume shadow copies.
234	vsiisexelauncher.exe	C:\Program Files (x86)\Microsoft Visual Studio\*	Binary will execute specified binary. Part of VS/VScode installation.
235	vsjitdebugger.exe	C:\Windows\System32\*	Just-In-Time (JIT) debugger included with Visual Studio
236	vsjitdebugger.exe	C:\Windows\SysWOW64\*	Just-In-Time (JIT) debugger included with Visual Studio
237	vsls-agent.exe	C:\Program Files (x86)\Microsoft Visual Studio\*	Agent for Visual Studio Live Share (Code Collaboration)
238	vstest.console.exe	C:\Program Files (x86)\Microsoft Visual Studio\*	VSTest.Console.exe is the command-line tool to run tests
239	vstest.console.exe	C:\Program Files\Microsoft Visual Studio\*	VSTest.Console.exe is the command-line tool to run tests
240	wab.exe	C:\Program Files (x86)\Windows Mail\*	Windows address book manager
241	wab.exe	C:\Program Files\Windows Mail\*	Windows address book manager
242	wbadmin.exe	C:\Windows\System32\*	Windows Backup Administration utility
243	wfc.exe	C:\Program Files (x86)\Microsoft SDKs\*	The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).
244	winproj.exe	C:\Program Files (x86)\Microsoft Office*	Microsoft Project Executable
245	winproj.exe	C:\Program Files\Microsoft Office*	Microsoft Project Executable
246	winword.exe	C:\Program Files (x86)\Microsoft Office*	Microsoft Office binary
247	winword.exe	C:\Program Files\Microsoft Office*	Microsoft Office binary
248	wlrmdr.exe	C:\Windows\System32\*	Windows Logon Reminder executable
249	wmic.exe	C:\Windows\System32\wbem\*	The WMI command-line (WMIC) utility provides a command-line interface for WMI
250	wmic.exe	C:\Windows\SysWOW64\wbem\*	The WMI command-line (WMIC) utility provides a command-line interface for WMI
251	workfolders.exe	C:\Windows\System32\*	Work Folders
252	wscript.exe	C:\Windows\System32\*	Used by Windows to execute scripts
253	wscript.exe	C:\Windows\SysWOW64\*	Used by Windows to execute scripts
254	wsreset.exe	C:\Windows\System32\*	Used to reset Windows Store settings according to its manifest file
255	wt.exe	C:\Program Files\WindowsApps\microsoft.windowsterminal_*	Windows Terminal
256	wuauclt.exe	C:\Windows\System32\*	Windows Update Client
257	xwizard.exe	C:\Windows\System32\*	Execute custom class that has been added to the registry or download a file with Xwizard.exe
258	xwizard.exe	C:\Windows\SysWOW64\*	Execute custom class that has been added to the registry or download a file with Xwizard.exe