added appid (principal) and exe hash