This is super useful. Thanks for sharing. I wish there was something out there where I could always see/check what folders are changed and what program is making external http calls to dodgy IPs. Then block the good jesus out of them.