sha256 \wwwroot\aspnet_client\;owa\auth;ecp\auth\;ClientAccess\Owa\;ClientAccess\Ecp\;ClientAccess\Oab\ w3wp.exe;UMWorkerProcess.exe;UMService.exe w3wp.exe UMWorkerProcess.exe UMService.exe .bat;.cmd;.exe;.js;.vbs;.vbe;.dll;.ps1 .rar;.zip;.7z;.js;.vbs;.vbe;.dll;.ps1 w3wp.exe UMWorkerProcess.exe .exe lsass.exe C:\Windows\system32\svchost.exe 0x1000 C:\Windows\system32\wbem\wmiprvse.exe 0x1400 C:\Windows\System32\svchost.exe 0x3000 C:\Windows\system32\wbem\wmiprvse.exe 0x1000 C:\Windows\System32\svchost.exe 0x1000 C:\Windows\system32\services.exe 0x1000 C:\Windows\system32\wininit.exe 0x1000000 C:\Windows\system32\csrss.exe 0x1fffff C:\Windows\system32\wininit.exe 0x1fffff powershell.exe;powershell_ise.exe System.Management.Automation C:\Windows\System32\ServerManager.exe C:\Windows\System32\RemoteFXvGPUDisablement.exe