FindWin10Old32ExE

FindWin10Old32ExE

import os
import pefile

exe_exception = open("exe_exception", "a")
exe_32 = open("exe_32", "a")


for root, dirs, files in os.walk(r"C:\\Windows"):
    for file in files:
        #print(root)
        fullname = os.path.join(root, file)
        name, suffix= os.path.splitext(fullname.lower())
        if ".exe" == suffix:
            try:
                pe = pefile.PE(fullname)
            except:
                exe_exception.write(fullname+"\n")
                continue
            if pe.FILE_HEADER.Machine == 0x14c:
                print(fullname)
                exe_32.write(fullname+"\n")



exe_exception.close()
exe_32.close()

import pefile
exe_32 = open("exe_32", "r")
pelist = []

for path in exe_32.readlines():
    try:
        pe = pefile.PE(path.strip())
        pelist.append((pe.FILE_HEADER.TimeDateStamp, path.strip()))
    except:
        continue

def take_second(elem):
    return elem[0]

pelist.sort(key=take_second)

exe_32_sort = open("exe_32.sort", "w")
for item in pelist:
    exe_32_sort.write(("%x---%s\n" % (item[0], item[1])))

exe_32_sort.close()

6ac5ce---C:\\Windows\SysWOW64\verifiergui.exe
6ac5ce---C:\\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.19041.1_none_7ab192ed7079aec0\verifiergui.exe
10f5be9---C:\\Windows\SysWOW64\mobsync.exe
10f5be9---C:\\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.19041.1_none_af96916428136673\mobsync.exe
14a25a2---C:\\Windows\SysWOW64\Register-CimProvider.exe
14a25a2---C:\\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.19041.1_none_238f55dfbfb45941\Register-CimProvider.exe
2062489---C:\\Windows\SysWOW64\notepad.exe
2062489---C:\\Windows\WinSxS\wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1_none_2f60455143be03e9\notepad.exe
2a48164---C:\\Windows\SysWOW64\regsvr32.exe
2a48164---C:\\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.19041.1_none_389cd5270341e0a8\regsvr32.exe
3a49928---C:\\Windows\SysWOW64\ttdinject.exe
3a49928---C:\\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\ttdinject.exe
3f0e21d---C:\\Windows\SysWOW64\Dism.exe
3f0e21d---C:\\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.746_none_46f79836a0dc7206\Dism.exe
434039e---C:\\Windows\SysWOW64\explorer.exe
434039e---C:\\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.867_none_39edfe890cfbc3df\explorer.exe
59f92e0---C:\\Windows\SysWOW64\fontdrvhost.exe
59f92e0---C:\\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.804_none_924a4e98ed97bec1\fontdrvhost.exe
6146631---C:\\Windows\SysWOW64\ipconfig.exe
6146631---C:\\Windows\WinSxS\wow64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.19041.1_none_0c7fa8d5ebaceac7\ipconfig.exe
6b09f44---C:\\Windows\SysWOW64\isoburn.exe
6b09f44---C:\\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_680d56683fad152b\isoburn.exe
6bf7916---C:\\Windows\SysWOW64\SndVol.exe
6bf7916---C:\\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.746_none_ae7666859aaa0664\SndVol.exe
6d58a56---C:\\Windows\SysWOW64\at.exe
6d58a56---C:\\Windows\WinSxS\wow64_microsoft-windows-at_31bf3856ad364e35_10.0.19041.1_none_0d475c3f57a2ce2b\at.exe
752c02e---C:\\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.746_none_b2b36a7e4037d315\wsmprovhost.exe
78b9adf---C:\\Windows\SysWOW64\psr.exe
78b9adf---C:\\Windows\WinSxS\wow64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.1_none_9b3749021eb80b64\psr.exe
7df4ad8---C:\\Windows\SysWOW64\chkdsk.exe
7df4ad8---C:\\Windows\WinSxS\wow64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.19041.1_none_822c11b6606ec606\chkdsk.exe
820d42c---C:\\Windows\SysWOW64\bitsadmin.exe
820d42c---C:\\Windows\WinSxS\wow64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.19041.1_none_0d5748d7e02a5474\bitsadmin.exe
94862f5---C:\\Windows\SysWOW64\WinRTNetMUAHostServer.exe
94862f5---C:\\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_b93dce693a9c6db9\WinRTNetMUAHostServer.exe
949f426---C:\\Windows\SysWOW64\rasautou.exe
949f426---C:\\Windows\WinSxS\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_f827f008f8832bd5\rasautou.exe
cfbf61a---C:\\Windows\SysWOW64\comp.exe
cfbf61a---C:\\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_c10c5c59091a9a90\comp.exe
d51248c---C:\\Windows\SysWOW64\winrs.exe
d51248c---C:\\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_d67c2e3d05659825\winrs.exe
d51248c---C:\\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.844_none_fe826cd7c4d920e8\winrs.exe
e38cdb5---C:\\Windows\SysWOW64\msdt.exe
e38cdb5---C:\\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.19041.1_none_65c819c8f144c1f4\msdt.exe
e53ab8b---C:\\Windows\SysWOW64\rasphone.exe
e53ab8b---C:\\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasphone.exe
e702dc4---C:\\Windows\SysWOW64\waitfor.exe
e702dc4---C:\\Windows\WinSxS\wow64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.19041.1_none_76ab6db74ef1e15e\waitfor.exe
e811f7f---C:\\Windows\SysWOW64\runas.exe
e811f7f---C:\\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.19041.1_none_202e011a312bab1d\runas.exe
eb245f4---C:\\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1_none_8119ed75508e4ffe\wevtutil.exe
f17aa3e---C:\\Windows\SysWOW64\net1.exe
f17aa3e---C:\\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_6f27e9e1e7c4fb87\net1.exe
10ab87c4---C:\\Windows\SysWOW64\autochk.exe
10ab87c4---C:\\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.804_none_ca6b236a54d28464\autochk.exe
126d9669---C:\\Windows\SysWOW64\quickassist.exe
126d9669---C:\\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.746_none_e64ec19a01f2ecde\quickassist.exe
13b1ab1d---C:\\Windows\SysWOW64\LaunchWinApp.exe
13b1ab1d---C:\\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.844_none_5bf36e214c92fadb\LaunchWinApp.exe
14e8ca0d---C:\\Windows\SysWOW64\shutdown.exe
14e8ca0d---C:\\Windows\WinSxS\wow64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.19041.1_none_c319cf869bb64064\shutdown.exe
1586c5f9---C:\\Windows\SysWOW64\SpatialAudioLicenseSrv.exe
1586c5f9---C:\\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.789_none_5ec57a7377ed8263\SpatialAudioLicenseSrv.exe
16414b10---C:\\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.1_none_cb8306be5498a914\imjpuexc.exe
16780341---C:\\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9c79736d61efaf52\imecfmui.exe
1769eb23---C:\\Windows\SysWOW64\wbem\mofcomp.exe
1769eb23---C:\\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.844_none_a19ff985b2ca712c\mofcomp.exe
17c78a7d---C:\\Windows\SysWOW64\SystemUWPLauncher.exe
17c78a7d---C:\\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\SystemUWPLauncher.exe
185b68f7---C:\\Windows\SysWOW64\WWAHost.exe
185b68f7---C:\\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1ab57d24625888e6\WWAHost.exe
18c8c27b---C:\\Windows\SysWOW64\ROUTE.EXE
18c8c27b---C:\\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\ROUTE.EXE
19b4bad6---C:\\Windows\SysWOW64\RMActivate_ssp_isv.exe
19b4bad6---C:\\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.19041.1_none_b55c875ed22d28bb\RMActivate_ssp_isv.exe
19ed157f---C:\\Windows\SysWOW64\recover.exe
19ed157f---C:\\Windows\WinSxS\wow64_microsoft-windows-recover_31bf3856ad364e35_10.0.19041.1_none_465905a4885947e8\recover.exe
1b3ebdb3---C:\\Windows\SysWOW64\TSTheme.exe
1b3ebdb3---C:\\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_be3404fb0dff5d84\TSTheme.exe
1b42f174---C:\\Windows\SysWOW64\appidtel.exe
1b42f174---C:\\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.546_none_171ecae34994f813\appidtel.exe
1cfbbd67---C:\\Windows\SysWOW64\xwizard.exe
1cfbbd67---C:\\Windows\WinSxS\wow64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.19041.1_none_1939c8a90c4232f6\xwizard.exe
1d384eb6---C:\\Windows\SysWOW64\ctfmon.exe
1d384eb6---C:\\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.19041.1_none_5d7644a9644fd29d\ctfmon.exe
1d91f38d---C:\\Windows\SysWOW64\sdchange.exe
1d91f38d---C:\\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.746_none_1fa60c4a9515d507\sdchange.exe
1e3ebce4---C:\\Windows\SysWOW64\takeown.exe
1e3ebce4---C:\\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_ba311d9fe95c6271\takeown.exe
1eab36f1---C:\\Windows\SysWOW64\mountvol.exe
1eab36f1---C:\\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.19041.1_none_729f314325319478\mountvol.exe
1ecef2eb---C:\\Windows\SysWOW64\CredentialUIBroker.exe
1ecef2eb---C:\\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_4c95cf26b3aa5907\CredentialUIBroker.exe
1ee3ae3b---C:\\Windows\SysWOW64\NETSTAT.EXE
1ee3ae3b---C:\\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\NETSTAT.EXE
1f5213a0---C:\\Windows\SysWOW64\logman.exe
1f5213a0---C:\\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\logman.exe
1fbf8e33---C:\\Windows\SysWOW64\mtstocom.exe
1fbf8e33---C:\\Windows\WinSxS\wow64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.19041.746_none_d1f5ce67827e350f\mtstocom.exe
22225238---C:\\Windows\SysWOW64\pcaui.exe
22225238---C:\\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.1_none_4247919c34819e8e\pcaui.exe
23f56ab1---C:\\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.441_none_8b35096d6dc0d7cb\TiFileFetcher.exe
242fe832---C:\\Windows\SysWOW64\CloudNotifications.exe
242fe832---C:\\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\CloudNotifications.exe
24f77be9---C:\\Windows\SysWOW64\RMActivate.exe
24f77be9---C:\\Windows\WinSxS\wow64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.19041.1_none_613b273905366660\RMActivate.exe
250c6ff8---C:\\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe
250c6ff8---C:\\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_f3894559140c31d7\imjpuexc.exe
251a1888---C:\\Windows\SysWOW64\RpcPing.exe
251a1888---C:\\Windows\WinSxS\wow64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.19041.1_none_5dffc5e61476cc4e\RpcPing.exe
25327c49---C:\\Windows\SysWOW64\provlaunch.exe
25327c49---C:\\Windows\WinSxS\wow64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.746_none_52d675501722c73d\provlaunch.exe
25327c49---C:\\Windows\WinSxS\wow64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.844_none_52d476a2172491b6\provlaunch.exe
254f48fb---C:\\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.804_none_587e52c2cfdab2ae\WerFault.exe
255abd58---C:\\Windows\SysWOW64\iexpress.exe
255abd58---C:\\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_f23fc9b9908be4fc\iexpress.exe
25a0fff7---C:\\Windows\SysWOW64\Taskmgr.exe
25a0fff7---C:\\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.844_none_9732d1507eb1227f\Taskmgr.exe
25bdc288---C:\\Windows\SysWOW64\mmc.exe
25bdc288---C:\\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.746_none_f7c1402f08d2457a\mmc.exe
25d5450e---C:\\Windows\SysWOW64\msiexec.exe
25d5450e---C:\\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.19041.1_none_09c72ca259d82b1b\msiexec.exe
27d3a83c---C:\\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.746_none_f3b7b83de249c055\wmplayer.exe
28c4c109---C:\\Windows\SysWOW64\regedt32.exe
28c4c109---C:\\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_dc7caa836f08ad57\regedt32.exe
2a1b4209---C:\\Windows\SysWOW64\ReAgentc.exe
2a1b4209---C:\\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\ReAgentc.exe
2a326fba---C:\\Windows\SysWOW64\wermgr.exe
2a326fba---C:\\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.746_none_08c4a734991442a9\wermgr.exe
2b792309---C:\\Windows\SysWOW64\unlodctr.exe
2b792309---C:\\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_b84e385529c68af9\unlodctr.exe
2c747db0---C:\\Windows\SysWOW64\wbem\WmiPrvSE.exe
2c747db0---C:\\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_f8b0afde1e951639\WmiPrvSE.exe
2cbedfda---C:\\Windows\SysWOW64\ntprint.exe
2cbedfda---C:\\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.746_none_d8516f5b109c3d64\ntprint.exe
2d5c8a4a---C:\\Windows\SysWOW64\bthudtask.exe
2d5c8a4a---C:\\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_4d67350a685e1a3a\bthudtask.exe
2d7e0dfd---C:\\Windows\SysWOW64\dtdump.exe
2d7e0dfd---C:\\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.662_none_746c3bfaa509091f\dtdump.exe
2e5708b6---C:\\Windows\Boot\PCAT\memtest.exe
2e5708b6---C:\\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.844_none_c08144da97cf2bf7\memtest.exe
2e7333a9---C:\\Windows\SysWOW64\tasklist.exe
2e7333a9---C:\\Windows\WinSxS\wow64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.19041.1_none_e888ea072e0fed05\tasklist.exe
2e73bf00---C:\\Windows\SysWOW64\runonce.exe
2e73bf00---C:\\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.746_none_fe08c9bb5237f8c0\runonce.exe
2eb4b5e5---C:\\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.423_none_c095dcd097bfe622\memtest.exe
2ed54455---C:\\Windows\SysWOW64\mfpmp.exe
2ed54455---C:\\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.746_none_84ad245a9ff1b143\mfpmp.exe
302746b6---C:\\Windows\SysWOW64\SearchProtocolHost.exe
302746b6---C:\\Windows\WinSxS\wow64_wi