Lookups

Which file names ship with a given OriginalFilename, as a searchable table and as lookup files you can load into a SIEM.

OriginalFilename → file names

922 values
OriginalFilenameShips as
"ApplyTrustOffline.PROGRAM"applytrustoffline.exe
"DeviceCredentialDeployment.exe"devicecredentialdeployment.exe
"nvspinfo.PROGRAM"nvspinfo.exe
.NET Hostdotnet.exe
accesschk.exeaccesschk.exe, accesschk64.exe
AccessEnum.exeaccessenum.exe
AddInProcess.exeaddinprocess.exe
AddInProcess32.exeaddinprocess32.exe
AddInUtil.exeaddinutil.exe
AdExpadexplorer.exe, adexplorer64.exe
ADInsightadinsight.exe, adinsight64.exe
adrestoreadrestore.exe, adrestore64.exe
ADVPACK.DLLadvpack.dll, ieadvpack.dll
AgentActivationRuntimeStarter.exeagentactivationruntimestarter.exe
AgentService.exeagentservice.exe
AggregatorHost.exeaggregatorhost.exe
ALG.exealg.exe
AMDNoiseSuppression.exeamdnoisesuppression.exe
appcmd.exeappcmd.exe
AppHostNameRegistrationVerifier.exeapphostregistrationverifier.exe
AppIDCertstoreCheck.exeappidcertstorecheck.exe
AppIDPolicyConverter.exeappidpolicyconverter.exe
APPIDTEL.EXEappidtel.exe
applaunch.exeapplaunch.exe
ApplicationFrameHost.exeapplicationframehost.exe
ApplySettingsTemplateCatalog.exeapplysettingstemplatecatalog.exe
ApproveChildRequest.exeapprovechildrequest.exe
AppVClient.exeappvclient.exe
AppVDllSurrogate.exeappvdllsurrogate.exe
appvnice.exeappvnice.exe
AppVShNotify.exeappvshnotify.exe
AppVStreamingUX.exeappvstreamingux.exe
arp.exearp.exe
aspnet_compiler.exeaspnet_compiler.exe
aspnet_regbrowsers.exeaspnet_regbrowsers.exe
aspnet_regiis.exeaspnet_regiis.exe
aspnet_regsql.exeaspnet_regsql.exe
aspnet_state.exeaspnet_state.exe
aspnet_wp.exeaspnet_wp.exe
AssignedAccessGuard.exeassignedaccessguard.exe
AT.EXEat.exe
ATBroker.exeatbroker.exe
ATIECLXX.EXEatieclxx.exe
ATTRIB.EXEattrib.exe
audioadg.exeaudiodg.exe
AUDIT.EXEaudit.exe
AUDITPOL.EXEauditpol.exe
AuditShD.exeauditshd.exe
AuthHost.exeauthhost.exe
AutoCatHost.exeautocathost.exe
AutoChk.Exeautochk.exe
AutoFsTx.Exeautofstx.exe
Autolog.exeautologon.exe, autologon64.exe
autoruns.exeautoruns.exe, autoruns64.exe, autorunsc.exe, autorunsc64.exe
AxInstUI.exeaxinstui.exe
BAAUPDATE.EXEbaaupdate.exe
backgroundTaskHost.exebackgroundtaskhost.exe
BackgroundTransferHost.exebackgroundtransferhost.exe
Bash.exebash.exe
bcdboot.exebcdboot.exe
bcdedit.exebcdedit.exe
bdechangepin.exebdechangepin.exe
BdeHdCfg.exebdehdcfg.exe
BDEUISRV.DLLbdeuisrv.exe
BDEUNLOCK.EXEbdeunlock.exe
bfsvc.exebfsvc.exe, ucsvc.exe
BGInfo.exebginfo.exe, bginfo64.exe
BioIso.exebioiso.exe
BitLockerDeviceEncryption.exebitlockerdeviceencryption.exe
BitLockerWizard.exebitlockerwizard.exe
BitLockerWizardElev.exebitlockerwizardelev.exe
bitsadmin.exebitsadmin.exe
bootim.exebootim.exe
bootsect.exebootsect.exe
bridgeunattend.exebridgeunattend.exe
browser_broker.EXEbrowser_broker.exe
BrowserCore.exebrowsercore.exe
browserexport.exebrowserexport.exe
bsdtartar.exe
BthUdTask.exebthudtask.exe
BytecodeGenerator.exebytecodegenerator.exe
Cachesetcacheset.exe, cacheset64.exe
CACLS.EXEcacls.exe
CALC.EXEcalc.exe
CameraSettingsUIHost.execamerasettingsuihost.exe
caspol.execaspol.exe
CastSrv.execastsrv.exe
CCG.execcg.exe
CertOC.execertoc.exe
CertReq.execertreq.exe
CertUtil.execertutil.exe
CExecSvc.execexecsvc.exe
change.exechange.exe
changepk.exechangepk.exe
changepkey.exechangepk.exe
charmap.execharmap.exe
CHCP.COMchcp.com
CheckNetIsolation.exechecknetisolation.exe
chglogon.exechglogon.exe
chgport.exechgport.exe
chgusr.exechgusr.exe
CHKDSK.EXEchkdsk.exe
CHKNTFS.EXEchkntfs.exe
choice.exechoice.exe
ChsIME.exechsime.exe
ChtIME.exechtime.exe
CIDiag.execidiag.exe
CIPHER.EXEcipher.exe
CiTool.execitool.exe
CLEANMGR.DLLcleanmgr.exe
cliconfg.execliconfg.exe
clip.execlip.exe
ClipDLS.execlipdls.exe
ClipRenew.execliprenew.exe
ClipUp.execlipup.exe
Clockresclockres.exe, clockres64.exe
CloudExperienceHostBroker.execloudexperiencehostbroker.exe
CloudNotifications.execloudnotifications.exe
clussvcclussvc.exe
Cmd.Execmd.exe
cmdiag.execmdiag.exe
cmdkey.execmdkey.exe
CMDL32.EXEcmdl32.exe
cmimageworker.execmimageworker.exe
CMMON32.execmmon32.exe
cmproxyd.execmproxyd.exe
CMSTP.EXEcmstp.exe
cofire.execofire.exe
colorcpl.execolorcpl.exe
Comp.Execomp.exe
COMPACT.EXEcompact.exe
CompatTelRunner.execompattelrunner.exe
CompMgmtLauncher.execompmgmtlauncher.exe
CompPkgSrv.execomppkgsrv.exe
ComputerDefaults.EXEcomputerdefaults.exe
COMREPL.EXEcomrepl.exe
ComSvcConfig.execomsvcconfig.exe
COMSVCS.DLLcomsvcs.dll
ConfigSecurityPolicy.execonfigsecuritypolicy.exe
ConfiguSecurityPolicy.execonfigsecuritypolicy.exe
CONHOST.EXEconhost.exe
consent.execonsent.exe
Contig.execontig.exe, contig64.exe
CONTROL.EXEcontrol.exe
CONVERT.EXEconvert.exe
ConvertVhd.execonvertvhd.exe
copilot_setup.execopilot_setup.exe
copilotapp.execopilotapp.exe
copilotapphost.dllcopilotapphost.exe
corebind.exenmbind.exe
coredpussvr.execoredpussvr.exe
coreinfocoreinfo.exe, coreinfo64.exe, coreinfoex.exe, coreinfoex64.exe
CPUSTREScpustres.exe, cpustres64.exe
CredentialEnrollmentManager.execredentialenrollmentmanager.exe
CredentialUIBroker.execredentialuibroker.exe
credwiz.execredwiz.exe
csc.execsc.exe
cscript.execscript.exe
CSRSS.Execsrss.exe
csvde.execsvde.exe
CTFMON.EXEctfmon.exe
ctrl2cap.exectrl2cap.exe
CTTUNE.EXEcttune.exe
CTTUNESVR.EXEcttunesvr.exe
curl.execurl.exe
CUSTOMINSTALLEXEC.EXEcustominstallexec.exe
CustomShellHost.execustomshellhost.exe
CVTRES.EXEcvtres.exe
dasHost.exedashost.exe
DataExchangeHost.exedataexchangehost.exe
DataStoreCacheDumpTool.exedatastorecachedumptool.exe
DataSvcUtil.exedatasvcutil.exe
Dbgview.exedbgview.exe, dbgview64.exe
dbgviewcli.exedbgviewcli.exe, dbgviewcli64.exe
dbInstaller.exedbinstaller.exe
dccw.exedccw.exe
DCOMCNFG.EXEdcomcnfg.exe
DDODiag.exeddodiag.exe
Defrag.EXEdefrag.exe
DESK.CPLdesk.cpl
desktopimgdownldr.exedesktopimgdownldr.exe
Desktopsdesktops.exe, desktops64.exe
DeviceCensus.exedevicecensus.exe
DeviceEject.EXEdeviceeject.exe
deviceenroller.exedeviceenroller.exe
DevicePairing.exedevicepairingwizard.exe
DeviceProperties.exedeviceproperties.exe
DevToolsLauncher.exedevtoolslauncher.exe
DFDWiz.exedfdwiz.exe
dfshim.dlldfshim.dll
dfsvc.exedfsvc.exe
DIALER.EXEdialer.exe
DirectXDatabaseUpdater.exedirectxdatabaseupdater.exe
Disk2vhddisk2vhd.exe, disk2vhd64.exe
diskext.exediskext.exe, diskext64.exe
Diskmon.exediskmon.exe, diskmon64.exe
diskpart.exediskpart.exe
DISKPERF.EXEdiskperf.exe
diskraid.exediskraid.exe
diskshadow.exediskshadow.exe
DiskSnapshot.exedisksnapshot.exe
diskusage.exediskusage.exe
DiskViewdiskview.exe, diskview64.exe
DISM.EXEdism.exe
DismHost.exedismhost.exe
dispdiag.exedispdiag.exe
DisplaySwitch.exedisplayswitch.exe
djoin.exedjoin.exe
dllhost.exedllhost.exe
dllhst3g.exedllhst3g.exe
dmcertinst.exedmcertinst.exe
dmcfghost.exedmcfghost.exe
dmclient.exedmclient.exe
DmNotificationBroker.exedmnotificationbroker.exe
DmOmaCpMo.exedmomacpmo.exe
dns.exedns.exe
dnscacheugc.exednscacheugc.exe
dnscmd.exednscmd.exe
DOSKEY.EXEdoskey.exe
dpapimig.exedpapimig.exe
DPISCALING.EXEdpiscaling.exe
DrvInst.EXEdrvinst.exe
drvqry.exedriverquery.exe
dsac.exedsac.exe
DSACLS.EXEdsacls.exe
dsDbUtil.exedsdbutil.exe
dsget.exedsget.exe
DsmUserTask.exedsmusertask.exe
dsquery.exedsquery.exe
dsregcmd.exedsregcmd.exe
dstokenclean.exedstokenclean.exe
DTDUMP.EXEdtdump.exe
dtrace.exedtrace.exe
du.exedu.exe, du64.exe
dump64.exedump64.exe
dusmtask.exedusmtask.exe
dvdplaydvdplay.exe
dwm.exedwm.exe
DWWINdwwin.exe
DXCap.exedxcap.exe
dxdiag.exedxdiag.exe
DXGIAdapterCache.exedxgiadaptercache.exe
DXPServer.EXEdxpserver.exe
Eap3Host.EXEeap3host.exe
EaseOfAccessDialog.exeeaseofaccessdialog.exe
easinvoker.exeeasinvoker.exe
EASPolicyManagerBrokerHost.exeeaspolicymanagerbrokerhost.exe
EdmGen.exeedmgen.exe
EDPCleanup.exeedpcleanup.exe
EdpNotify.exeedpnotify.exe
eduprintprov.exeeduprintprov.exe
efsdump.exeefsdump.exe
efsui.exeefsui.exe
EhStorAuthn.exeehstorauthn.exe
elevated_tracing_service.exeelevated_tracing_service.exe
EnrollComServer.execertenrollctrl.exe
EoaExperiences.exeeoaexperiences.exe
esentutl.exeesentutl.exe
EUDCEDIT.EXEeudcedit.exe
evcreate.exeeventcreate.exe
eventvwr.exeeventvwr.exe
expandexpand.exe
EXPLORER.EXEexplorer.exe
extexport.exeextexport.exe
extrac32.exeextrac32.exe
extractr.exewimserv.exe
F12Chooser.exeiechooser.exe
FC.EXEfc.exe
FClip.exefclip.exe
fhmanagew.exefhmanagew.exe
FileDialogBroker.exefiledialogbroker.exe
FileHistory.exefilehistory.exe
FIND.EXEfind.exe
findlinks.exefindlinks.exe, findlinks64.exe
FINDSTR.EXEfindstr.exe
finger.exefinger.exe
FirstLogonAnim.exefirstlogonanim.exe
FIXMAPI.EXEfixmapi.exe
fltMC.exefltmc.exe
FodHelper.EXEfodhelper.exe
Fondue.EXEfondue.exe
fontdrvhost.exefontdrvhost.exe
FONTVIEW.EXEfontview.exe
forfiles.exeforfiles.exe
format.comformat.com
fsavailux.exefsavailux.exe
FsIso.exefsiso.exe
fsquirt.exefsquirt.exe
fsutil.exefsutil.exe
ftp.exeftp.exe
FVENOTIFY.EXEfvenotify.exe
FVEPROMPT.EXEfveprompt.exe
FXSSVC.EXEfxssvc.exe
GamebarPresenceWriter.exegamebarpresencewriter.exe
GameInputSvc.exegameinputsvc.exe
gamepanel.exegamepanel.exe
GenValObj.exegenvalobj.exe
GetMac.exegetmac.exe
gprslt.exegpresult.exe
GPSCRIPT.EXEgpscript.exe
GPUpdate.exegpupdate.exe
GRPCONV.EXEgrpconv.exe
HdwWiz.EXEhdwwiz.exe
HealthAttestationClientAgent.exehealthattestationclientagent.exe
Help.Exehelp.exe
HelpPane.exehelppane.exe
hex2dec.exehex2dec.exe, hex2dec64.exe
HH.exehh.exe
hiberrsm.exewinresume.exe
hostname.exehostname.exe
hvax64.exehvax64.exe
hvix64.exehvix64.exe
HvsiEvaluator.exehvsievaluator.exe
HvsiProxyApp.exehvsiproxyapp.exe
HvsiSettingsWorker.exehvsisettingsworker.exe
Hyper-V Command Line Toolhvc.exe
Hyper-V Host Compute Service Diagnostics Toolhcsdiag.exe
Hyper-V Host Network Service Diagnostics Toolhnsdiag.exe
iCACLS.EXEicacls.exe
icsunattend.exeicsunattend.exe
IE4UINIT.EXEie4uinit.exe
IE4USHOWIE.EXEie4ushowie.exe
IEDiagCmd.exeiediagcmd.exe
IEFRAME.DLLieframe.dll
ieinstal.exeieinstal.exe
IESettingSync.exeiesettingsync.exe
IEUNATT.EXEieunatt.exe
IEXPLORE.EXEiexplore.exe
IEXPRESS.EXEiexpress.exe
iissetup.exeiissetup.exe
ilasm.exeilasm.exe
ImagingDevices.cplimagingdevices.exe
IMCCPHR.exeimccphr.exe
ImeBroker.exeimebroker.exe
imecfmui.exeimecfmui.exe
imesearch.exeimesearch.exe
imewdbld.exeimewdbld.exe
imjpdct.exeimjpdct.exe
IMJPSET.exeimjpset.exe
imjpuex.exeimjpuex.exe
imjpuexc.exeimjpuexc.exe
ImmersiveTpmVscMgrSvr.exeimmersivetpmvscmgrsvr.exe
IMTCLNWZ.exeimtclnwz.exe
IMTCPROP.exeimtcprop.exe
InfDefaultInstall.EXEinfdefaultinstall.exe
InputSwitchToastHandler.exeinputswitchtoasthandler.exe
InspectVhdDialog.exeinspectvhddialog.exe
InstallUtil.exeinstallutil.exe
instnm.exeinstnm.exe
iotstartup.exeiotstartup.exe
ipconfig.exeipconfig.exe
iscsicli.exeiscsicli.exe
iscsicpl.exeiscsicpl.exe
isetup.exesetup.exe
ISM.exeism.exe
ISOBURN.EXEisoburn.exe
jsc.exejsc.exe
junction.exejunction.exe, junction64.exe
klist.exeklist.exe
ksetup.exeksetup.exe
ktmutil.exektmutil.exe
la57setup.dllla57setup.exe
Label.Exelabel.exe
LanguageComponentsInstallerComHandler.exelanguagecomponentsinstallercomhandler.exe
LaunchTM.exelaunchtm.exe
LaunchWinApp.exelaunchwinapp.exe
ldifde.exeldifde.exe
LegacyNetUXHost.exelegacynetuxhost.exe
lhdfrgui.exedfrgui.exe
LicenseManagerShellExt.exelicensemanagershellext.exe
LicensingDiag.exelicensingdiag.exe
LicensingUI.exelicensingui.exe
LINK.EXElink.exe
Listdlls.exelistdlls.exe, listdlls64.exe
LiveCaptions.exelivecaptions.exe
livekd.exelivekd.exe, livekd64.exe
Loadordloadord.exe, loadord64.exe, loadordc.exe, loadordc64.exe
locator.exelocator.exe
LockAppHost.exelockapphost.exe
LockScreenContentServer.exelockscreencontentserver.exe
LODCTR.EXElodctr.exe
logagent.exelogagent.exe
Logman.exelogman.exe
logoff.exelogoff.exe
logonsessions.exelogonsessions.exe, logonsessions64.exe
logonui.exelogonui.exe
lpkinstall.exelpkinstall.exe
lpksetup.exelpksetup.exe
lpremove.exelpremove.exe
LsaIso.exelsaiso.exe
lsass.exelsass.exe
makecab.exemakecab.exe
manage-bde.exemanage-bde.exe
ManagedWindowsVM.exemanagedwindowsvm.exe
mavinject32.exemavinject.exe
mavinject64.exemavinject.exe
MBLCTR.EXEmblctr.exe
mbr2gpt.exembr2gpt.exe
mcbuilder.exemcbuilder.exe
MCU.exemcu.exe
MDEServer.exemdeserver.exe
MDMAgentmdmagent.exe
MDMAppInstaller.exemdmappinstaller.exe
MdmDiagnosticsTool.exemdmdiagnosticstool.exe
MdRes.exemdres.exe
MdSched.exemdsched.exe
mf.dllmfpmp.exe
Microsoft IMEimepadsv.exe
Microsoft.IdentityServer.ServiceHost.exemicrosoft.identityserver.servicehost.exe
Microsoft.Uev.CscUnpinTool.exemicrosoft.uev.cscunpintool.exe
Microsoft.Uev.SyncController.exemicrosoft.uev.synccontroller.exe
Microsoft.Workflow.Compiler.exemicrosoft.workflow.compiler.exe
MicrosoftEdge.exemicrosoftedge.exe
MicrosoftEdgeCP.exemicrosoftedgebchost.exe, microsoftedgecp.exe, microsoftedgedevtools.exe
MicrosoftEdgeSH.exemicrosoftedgesh.exe
midisrv.exemidisrv.exe
MigHost.exemighost.exe
MIGREGDB.EXEmigregdb.exe
MLEngineStubmlenginestub.exe
mmc.exemmc.exe
mmgaserver.exemmgaserver.exe
mobsync.exemobsync.exe
MODE.COMmode.com
mofcomp.exemofcomp.exe
MoNotificationUxStubmonotificationuxstub.exe
MORE.COMmore.com
MOUNTVOL.EXEmountvol.exe
MoUSOCoreWorker.exemousocoreworker.exe
movefilemovefile.exe, movefile64.exe
MpCmdRun.exempcmdrun.exe
MpCopyAccelerator.exempcopyaccelerator.exe
mpnotify.exempnotify.exe
MpSigStub.exempsigstub.exe
MptfGenericService.exemptfgenericservice.exe
MQSVC.EXEmqsvc.exe
mrinfo.exemrinfo.exe
mrt.exemrt.exe
MSBuild.exemsbuild.exe
MSchedExe.EXEmschedexe.exe
msconfig.EXEmsconfig.exe
mscopilot.exemscopilot.exe
mscorsvw.exemscorsvw.exe
msdt.exemsdt.exe
MSDTC.EXEmsdtc.exe
msedgewebview2.exemsedgewebview2.exe
msfeedssync.exemsfeedssync.exe
msg.exemsg.exe
MSHTA.EXEmshta.exe
MSHTML.DLLmshtml.dll
msiexec.exemsiexec.exe
msinfo.dllmsinfo32.exe
MsMpEng.exemsmpeng.exe
msoobe.exemsoobe.exe
msra.exemsra.exe
MsSpellCheckingHost.exemsspellcheckinghost.exe
mstsc.exemstsc.exe
MTKBTSVC.exemtkbtsvc.exe
MTSTOCOM.EXEmtstocom.exe
MuiUnattend.exemuiunattend.exe
MultiDigiMon.exemultidigimon.exe
nbtinfo.exenbtstat.exe
NDAdmin.EXEndadmin.exe
net.exenet.exe
net1.exenet1.exe
netbtugc.exenetbtugc.exe
netcfg.exenetcfg.exe
NetCfgNotifyObjectHost.exenetcfgnotifyobjecthost.exe
NETDOM.EXEnetdom.exe
NetEvtFwdr.EXEnetevtfwdr.exe
nethost.exenethost.exe
netiougc.exenetiougc.exe
NETPLWIZ.EXEnetplwiz.exe
netsh.exenetsh.exe
netstat.exenetstat.exe
NewDev.EXEnewdev.exe
NgcIso.exengciso.exe
ngen.exengen.exe
NGenTask.exengentask.exe
NisSrv.exenissrv.exe
nltest.exenltest.exe
nltestrk.exenltest.exe
nmscrub.exenmscrub.exe
NOTEPAD.EXEnotepad.exe
notification_helper.exenotification_helper.exe
NotMyfault.exenotmyfault.exe, notmyfault64.exe
NotMyfaultC.exenotmyfaultc.exe, notmyfaultc64.exe
NpcapHelper.exenpcaphelper.exe
nslookup.exenslookup.exe
ntdsutil.exentdsutil.exe
NtfsInfo.exentfsinfo.exe, ntfsinfo64.exe
Nthandle.exehandle.exe, handle64.exe
ntkrnlmp.exentoskrnl.exe
ntprint.exentprint.exe
odbcad32.exeodbcad32.exe
odbcconf.exeodbcconf.exe
OFDEPLOY.EXEofdeploy.exe
OfflineScannerShell.exeofflinescannershell.exe
omadmclient.exeomadmclient.exe
omadmprc.exeomadmprc.exe
OneDriveSetup.exeonedrivesetup.exe
OneNoteIm.exeonenoteim.exe
OOBEFodSetup.exeoobefodsetup.exe
OOBELDR.EXEoobeldr.exe
OobeShellHost.exeoobeshellhost.exe
OpenConsole.exeopenconsole.exe
OpenWith.exeopenwith.exe
opnfiles.exeopenfiles.exe
oposhost.exeoposhost.exe
OptionalFeatures.EXEoptionalfeatures.exe
osk.exeosk.exe
osloader.exewinload.exe
pacjsworker.exepacjsworker.exe
PackagedCWALauncher.exepackagedcwalauncher.exe
PACKAGEINSPECTOR.EXEpackageinspector.exe
pairtool.exepairtool.exe
PasswordOnWakeSettingFlyout.exepasswordonwakesettingflyout.exe
pathping.exepathping.exe
pcaui.exepcaui.exe
pcwrun.exepcwrun.exe
pcwutl.dllpcwutl.dll
pendmoves.exependmoves.exe, pendmoves64.exe
perfhost.exeperfhost.exe
perfmon.exeperfmon.exe
phoneactivate.exephoneactivate.exe
PhotoViewer.dllphotoviewer.dll
PickerHost.exepickerhost.exe
PinEnrollmentBroker.exepinenrollmentbroker.exe
ping.exeping.exe
pipelist.exepipelist.exe, pipelist64.exe
PkgMgr.exepkgmgr.exe
PktMon.exepktmon.exe
plasrv.exeplasrv.exe
platform_experiences_helper.exeplatform_experiences_helper.exe
PlayReady Process EXEprproc.exe
PnPUnattend.exepnpunattend.exe
pnputil.exe, PnPutil.exepnputil.exe
poqexec.exepoqexec.exe
Portmon.exeportmon.exe
PowerCfg.exepowercfg.exe
PowerShell.EXEpowershell.exe
powershell_ise.EXEpowershell_ise.exe
PresentationHost.exepresentationhost.exe
PresentationSettings.exepresentationsettings.exe
PREVHOST.EXEprevhost.exe
Print.Exeprint.exe
PrintBrm.exeprintbrm.exe
PrintBrmUi.exeprintbrmui.exe
PrintFilterPipelineSvc.exeprintfilterpipelinesvc.exe
PrintIsolationHost.exeprintisolationhost.exe
printui.exeprintui.exe
procdumpprocdump.exe, procdump64.exe
Process Monitorprocmon.exe, procmon64.exe
Procexp.exeprocexp.exe, procexp64.exe
proquota.exeproquota.exe
provlaunchprovlaunch.exe
provtoolprovtool.exe
ProximityUxHost.exeproximityuxhost.exe
psexec.cpsexec.exe, psexec64.exe
psfile.exepsfile.exe, psfile64.exe
PsGetSid.exepsgetsid.exe, psgetsid64.exe
Psinfo.exepsinfo.exe, psinfo64.exe
pskill.exepskill.exe, pskill64.exe
pslist.exepslist.exe, pslist64.exe
psloggedon.exepsloggedon.exe, psloggedon64.exe
psloglist.exepsloglist.exe, psloglist64.exe
pspasswd.exepspasswd.exe, pspasswd64.exe
psping.exepsping.exe, psping64.exe
psr.exepsr.exe
psservice.exepsservice.exe, psservice64.exe
psshutdown.exepsshutdown.exe, psshutdown64.exe
pssuspend.exepssuspend.exe, pssuspend64.exe
pwlauncher.exepwlauncher.exe
pwsh.dllpwsh.dll, pwsh.exe
qappsrv.exeqappsrv.exe
qprocess.exeqprocess.exe
query.exequery.exe
quser.exequser.exe
qwinsta.exeqwinsta.exe
RamMaprammap.exe, rammap64.exe
RASDIAL.EXErasdial.exe
rasdlui.exerasautou.exe
raserver.exeraserver.exe
rasphone.exerasphone.exe
RDCMan-x86.dllrdcman-x86.exe
RDCMan.dllrdcman.exe
RdmaPerf.sysndkperfcmd.exe
RdmaPing.sysndkping.exe
rdpclip.exerdpclip.exe
rdpinit.exerdpinit.exe
rdpinput.exerdpinput.exe
RdpSa.exerdpsa.exe
RdpSaProxy.exerdpsaproxy.exe
RdpSaUacHelper.exerdpsauachelper.exe
rdpshell.exerdpshell.exe
RdrLeakDiag.exerdrleakdiag.exe
readCloudDataSettings.exereadclouddatasettings.exe
reagentc.exereagentc.exe
recdisc.exerecdisc.exe
Recover.Exerecover.exe
RECOVERYDRIVE.EXErecoverydrive.exe
ReFsDedupSvc.exerefsdedupsvc.exe
refsutil.exerefsutil.exe
reg.exereg.exe
RegAsm.exeregasm.exe
RegDelNull.exeregdelnull.exe, regdelnull64.exe
REGEDIT.EXEregedit.exe
regedt32.exeregedt32.exe
REGINI.EXEregini.exe
Register-CimProvider2.exeregister-cimprovider.exe
regjump.exeregjump.exe
Regsize1ru.exe, ru64.exe
RegSvcs.exeregsvcs.exe
REGSVR32.EXEregsvr32.exe
rekeywiz.exerekeywiz.exe
Relog.exerelog.exe
RelPost.exerelpost.exe
RemotePosWorker.exeremoteposworker.exe
repadmin.exerepadmin.exe
repair-bde.exerepair-bde.exe
REPLACE.EXEreplace.exe
reset.exereset.exe
RESETENGINE.EXEresetengine.exe
resmon.exeresmon.exe
RestartAgent.exerestartagent.exe
rgnupdt.exergnupdt.exe
rmactivate.exermactivate.exe, rmactivate_isv.exe
rmactivate_ssp.exermactivate_ssp.exe
rmactivate_ssp_isv.exermactivate_ssp_isv.exe
RmClient.exermclient.exe
RmtTpmVscMgrSvr.exermttpmvscmgrsvr.exe
robocopy.exerobocopy.exe
route.exeroute.exe
RpcPing.exerpcping.exe
rrinstaller.exerrinstaller.exe
rstrui.exerstrui.exe
RUNAS.EXErunas.exe
RUNDLL32.EXErundll32.exe
RunExeHelper.exerunexehelper.exe
RunLegacyCPLElevated.EXErunlegacycplelevated.exe
RUNONCE.EXErunonce.exe
runscripthelper.exerunscripthelper.exe
RuntimeBroker.exeruntimebroker.exe
RUXIMICS.exeruximics.exe
RUXIMIH.exeruximih.exe
rwinsta.exerwinsta.exe
sc.exesc.exe
schtasks.exeschtasks.exe
ScrConsscrcons.exe
ScreenMagnifier.exemagnify.exe
ScriptRunner.exescriptrunner.exe
scrobj.dllscrobj.dll
sctasks.exeschtasks.exe
sdbinst.exesdbinst.exe
sdchange.exesdchange.exe
sdclt.exesdclt.exe
sdelete.exesdelete.exe, sdelete64.exe
sdiagnhost.exesdiagnhost.exe
SearchFilterHost.exesearchfilterhost.exe
SearchIndexer.exesearchindexer.exe
SearchProtocolHost.exesearchprotocolhost.exe
SeCEditsecedit.exe
secinitsecinit.exe
securekernel.exesecurekernel.exe
SecurityHealthHost.exesecurityhealthhost.exe
SecurityHealthService.exesecurityhealthservice.exe
SecurityHealthSystray.exesecurityhealthsystray.exe
SensorDataService.exesensordataservice.exe
SensorRuntimeBroker.exesensorruntimebroker.exe
ServiceModelReg.exeservicemodelreg.exe
services.exeservices.exe
SessionMsg.exesessionmsg.exe
sethc.exesethc.exe
setspn.exesetspn.exe
SettingSyncHost.exesettingsynchost.exe
SETUP.EXEsetup.exe, setup16.exe
SETUPAPI.DLL, setupapi.dllsetupapi.dll
Setupcl.EXEsetupcl.exe
SETUPUGC.EXEsetupugc.exe
setx.exesetx.exe
sfc.exesfc.exe
ShareEnumshareenum.exe, shareenum64.exe
SHDOCVW.DLLshdocvw.dll
SHELL32.DLL, shell32.dllshell32.dll
ShellAppRuntime.exeshellappruntime.exe
ShellHost.exeshellhost.exe
ShellRunasshellrunas.exe
shimgvw.dllshimgvw.dll
shrpubw.exeshrpubw.exe
SHUTDOWN.EXEshutdown.exe
sigcheck.exesigcheck.exe, sigcheck64.exe
sigverif.exesigverif.exe
sihclient.exesihclient.exe
sihost.exesihost.exe
SlideToShutDown.exeslidetoshutdown.exe
slui.exeslui.exe
smartscreen.exesmartscreen.exe
smss.exesmss.exe
SMSvcHost.exesmsvchost.exe
SndVol.exesndvol.exe
SnippingTool.exesnippingtool.exe
snmptrap.exesnmptrap.exe
Sort.EXEsort.exe
SpaceAgent.exespaceagent.exe
spaceman.exespaceman.exe
spaceutil.exespaceutil.exe
SpatialLicenseSrv.exespatialaudiolicensesrv.exe
SpeechModelDownload.exespeechmodeldownload.exe
SpeechRuntime.exespeechruntime.exe
SpeechUXWiz.exespeechuxwiz.exe
splwow64.exesplwow64.exe
spoolsv.exespoolsv.exe
spoolsvworker.exespoolsvworker.exe
SppExtComObj.exesppextcomobj.exe
sppsvc.exesppsvc.exe
SqlDumper.exesqldumper.exe
SQLSERVR.EXEsqlservr.exe
SQLWRITER.EXEsqlwriter.exe
SR.exenarrator.exe
srdelayed.exesrdelayed.exe
srtasks.exesrtasks.exe
SSystemPropertiesProtection.EXEsystempropertiesprotection.exe
stordiag.exestordiag.exe
streams.exestreams.exe, streams64.exe
strings.exestrings.exe, strings64.exe
Subst.Exesubst.exe
svchost.exesvchost.exe
sxstrace.exesxstrace.exe
Sync.exesync.exe, sync64.exe
syncappvpublishingserver.exe, SyncAppvPublishingServer.exesyncappvpublishingserver.exe
SyncHost.EXEsynchost.exe
sysinfo.exesysteminfo.exe
sysmon.exesysmon.exe
sysprep.EXEsysprep.exe
SysResetErr.exesysreseterr.exe
SYSSETUP.DLLsyssetup.dll
SystemPropertiesAdvanced.EXEsystempropertiesadvanced.exe
SystemPropertiesComputerName.EXEsystempropertiescomputername.exe
SystemPropertiesDataExecutionPrevention.EXEsystempropertiesdataexecutionprevention.exe
SystemPropertiesHardware.EXEsystempropertieshardware.exe
SystemPropertiesPerformance.EXEsystempropertiesperformance.exe
SystemPropertiesRemote.EXEsystempropertiesremote.exe
SystemSettingsAdminFlows.EXEsystemsettingsadminflows.exe
SystemSettingsBroker.exesystemsettingsbroker.exe
SystemSettingsRemoveDevice.exesystemsettingsremovedevice.exe
SystemUWPLauncher.exesystemuwplauncher.exe
systray.exesystray.exe
tabcal.exetabcal.exe
takeown.exetakeown.exe
TapiUnattend.exetapiunattend.exe
taskhostw.exetaskhostw.exe
taskkill.exetaskkill.exe
tasklist.exetasklist.exe
Taskmgr.exe, taskmgr.exetaskmgr.exe
tcblaunch.exetcblaunch.exe
TCMSETUP.EXEtcmsetup.exe
TCPSVCS.EXEtcpsvcs.exe
Tcpvcon.exetcpvcon.exe, tcpvcon64.exe
TcpView.exetcpview.exe, tcpview64.exe
Testlimittestlimit.exe, testlimit64.exe
ThumbnailExtractionHost.EXEthumbnailextractionhost.exe
TieringEngineService.exetieringengineservice.exe
timeout.exetimeout.exe
TiWorker.exetiworker.exe
TokenBrokerCookies.exetokenbrokercookies.exe
TpmInit.EXEtpminit.exe
tpmtool.exetpmtool.exe
TpmVscMgr.exetpmvscmgr.exe
TpmVscMgrSvr.exetpmvscmgrsvr.exe
TraceRpt.Exetracerpt.exe
tracert.exetracert.exe
TREE.COMtree.com
TrustedInstaller.exetrustedinstaller.exe
tscon.exetscon.exe
tsdiscon.exetsdiscon.exe
tskill.exetskill.exe
tssdis.exetssdis.exe
TSSignTool.exerdpsign.exe
TSThemeS.exetstheme.exe
TSWbPrxy.exetswbprxy.exe
TTDInject.EXEttdinject.exe
TTTracer.exetttracer.exe
TypePerf.exetypeperf.exe
tzsync.exetzsync.exe
tzutil.exetzutil.exe
UCPDMgr.exeucpdmgr.exe
UevAgentPolicyGenerator.exeuevagentpolicygenerator.exe
UevAppMonitor.exeuevappmonitor.exe
UevTemplateBaselineGenerator.exeuevtemplatebaselinegenerator.exe
UevTemplateConfigItemGenerator.exeuevtemplateconfigitemgenerator.exe
UIEOrchestratorStubuieorchestratorstub.exe
UIMgrBroker.exeuimgrbroker.exe
UNLODCTR.EXEunlodctr.exe
unregmp2.exeunregmp2.exe
unsecapp.dllunsecapp.exe
updatecliupdatecli.exe
upfc.exeupfc.exe
UpgradeResultsUI.exeupgraderesultsui.exe
upnpcont.dllupnpcont.exe
UPPrinterInstaller.exeupprinterinstaller.exe
URL.DLLurl.dll
User.exeuser.exe
UserAccountBroker.exeuseraccountbroker.exe
UserAccountControlSettings.exeuseraccountcontrolsettings.exe
UserDataSource.exeuserdatasource.exe
USERINIT.EXEuserinit.exe
UserOOBEBroker.exeuseroobebroker.exe
UsoClientusoclient.exe
UtcDecoderHost.exeutcdecoderhost.exe
UtilitySessionMinLogon.exeutilitysessionminlogon.exe
utilman2.exeutilman.exe
VAULTCMD.EXEvaultcmd.exe
vbc.exevbc.exe
vds.exevds.exe
vdsldr.exevdsldr.exe
verclsid.exeverclsid.exe
verifier.exeverifier.exe
verifiergui.exeverifiergui.exe
vfpctrl.exevfpctrl.exe
vmcompute.exevmcompute.exe
VmComputeAgent.exevmcomputeagent.exe
VMConnect.exevmconnect.exe
Vmmapvmmap.exe, vmmap64.exe
vmms.exevmms.exe
vmnat.exevmnat.exe
vmnetdhcp.exevmnetdhcp.exe
VmPlatformCa.exevmplatformca.exe
vmsp.exevmsp.exe
vmwp.exevmwp.exe
VoiceAccess.exevoiceaccess.exe
volumeid.exevolumeid.exe, volumeid64.exe
VSDiagnostics.exevsdiagnostics.exe
VSSADMIN.EXEvssadmin.exe
VSSVC.EXEvssvc.exe
w32time.dllw32tm.exe
w3wp.exew3wp.exe
WAB.EXEwab.exe
WABMIG.EXEwabmig.exe
waitfor.exewaitfor.exe
WallpaperHost.EXEwallpaperhost.exe
WBADMIN.EXEwbadmin.exe
wbemtest.exewbemtest.exe
wbengine.exewbengine.exe
wcodstub.dlldplaysvr.exe, dpnsvr.exe
wcsetupagent.exewcsetupagent.exe
WECUTIL.EXEwecutil.exe
WerFault.exewerfault.exe
WerFaultSecure.exewerfaultsecure.exe
WerMgrwermgr.exe
wevtutil.exewevtutil.exe
WEXTRACT.EXE wextract.exe
where.exewhere.exe
whoami.exewhoami.exe
whois.exewhois.exe, whois64.exe
WIAACMGR.EXEwiaacmgr.exe
wiawow64.exewiawow64.exe
WiFiTask.exewifitask.exe
WinBioDataModelOOBE.exewinbiodatamodeloobe.exe
WinDeploy.exewindeploy.exe
Windows.Media.Playback.exewindows.media.backgroundplayback.exe
Windows.WARP.JITService.exewindows.warp.jitservice.exe
WindowsActionDialog.exewindowsactiondialog.exe
WindowsSandbox.exewindowssandbox.exe
WindowsSandboxClient.exewindowssandboxclient.exe
WindowsUpdateElevatedInstallerwindowsupdateelevatedinstaller.exe
WINHLP32.EXEwinhlp32.exe
WinInit.exewininit.exe
WINLOGON.EXEwinlogon.exe
winmgmt.exewinmgmt.exe
WinObj.exewinobj.exe, winobj64.exe
winrs.exewinrs.exe
winrshost.exewinrshost.exe
WinRTNetMUAHostServer.exewinrtnetmuahostserver.exe
WinSAT.exewinsat.exe
WINVER.EXEwinver.exe
wkspbroker.exewkspbroker.exe
wksprt.exewksprt.exe
wlanext.exewlanext.exe
WlanHelper.exewlanhelper.exe
wldp.dllwldp.dll
WLRMNDR.EXEwlrmdr.exe
WmiApSrv.exewmiapsrv.exe
wmic.exewmic.exe
wmicookr.dllwmiadap.exe
Wmiprvse.exewmiprvse.exe
WMPDMC.exewmpdmc.exe
wmplayer.exewmplayer.exe
wmprph.exewmprph.exe
WORDPAD.EXEwordpad.exe
WorkFolders.exeworkfolders.exe
WOWREG32.EXEwowreg32.exe
WpcMon.exewpcmon.exe
WpcTok.exewpctok.exe
WpdShExtAutoplay.exewpdshextautoplay.exe
wpnpinst.exewpnpinst.exe
WPR.exewpr.exe
writewrite.exe
WsatConfig.exewsatconfig.exe
wscadminui.exewscadminui.exe
WSCollect.exewscollect.exe
wscript.exewscript.exe
wsl.exewsl.exe
wslconfig.exewslconfig.exe
wslhost.exewslhost.exe
WSManHTTPConfig.exewsmanhttpconfig.exe
wsmprovhost.exewsmprovhost.exe
wsqmcons.exewsqmcons.exe
WSReset.exewsreset.exe
WsusService.exewsusservice.exe
wuapihost.exewuapihost.exe
wuauclt.exewuauclt.exe
wuaucltcore.exewuaucltcore.exe
WUDFCompanionHost.exewudfcompanionhost.exe
WUDFHost.exewudfhost.exe
wusa.exewusa.exe
WWAHost.exewwahost.exe
XblGameSaveTask.exexblgamesavetask.exe
xbootmgr.exexbootmgr.exe
xbootmgrSleep.exexbootmgrsleep.exe
XCOPY.EXExcopy.exe
xwizard.exexwizard.exe
ZIPFLDR.DLLzipfldr.dll
ZoomIt.exezoomit.exe, zoomit64.exe

Downloads

FileContents
ofn_pairs.csvLowercase original_filename,image_name pairs. A Splunk or Cribl lookup table for rename detection.
ofn_pairs.kqlThe same pairs as a KQL datatable for Defender XDR and Sentinel.
ofn.csvOne row per (binary, OriginalFilename): builds, architectures, version and Windows-release span, provenance, category.
ofn.jsonOne object per binary: every OriginalFilename value, the current one, flags, and whether Sysmon confirmed it.

Regenerated with the data (2026-10-26); 1,003 pairs. Data is CC BY 4.0: use it in your detections and credit ofndb.

Using the pairs: catch renamed binaries

A process whose OriginalFilename is CertUtil.exe but whose image is update.exe was renamed. Flag events whose OriginalFilename is in the lookup but whose (OriginalFilename, file name) pair isn't.

Splunk (CIM)

| tstats summariesonly=false count from datamodel=Endpoint.Processes
    by Processes.dest Processes.process_name Processes.original_file_name Processes.process_path
| rename Processes.* as *
| eval ofn=lower(original_file_name), img=lower(process_name)
| lookup ofn_pairs.csv original_filename AS ofn OUTPUT original_filename AS tracked
| lookup ofn_pairs.csv original_filename AS ofn image_name AS img OUTPUT image_name AS expected
| where isnotnull(tracked) AND isnull(expected)

Defender KQL

// paste the contents of ofn_pairs.kql above this line
DeviceProcessEvents
| extend ofn = tolower(ProcessVersionInfoOriginalFileName), img = tolower(FileName)
| where ofn in ((ofn_pairs | distinct ofn))
| join kind=leftanti ofn_pairs on ofn, img

Cribl Stream

Eval:      ofn = (OriginalFileName || '').toLowerCase()
           img = (Image || '').split('\\').pop().toLowerCase()
Lookup #1: ofn_pairs.csv, match original_filename = ofn                    -> output original_filename AS tracked
Lookup #2: ofn_pairs.csv, match original_filename = ofn, image_name = img -> output image_name AS expected
Filter:    tracked && !expected

Expect benign hits from software that bundles a Windows binary under its own name, and from binaries this library doesn't cover yet. Tune with path and signer.