A security analyst is building a server profile for a company's internal application server so that future deviations can be detected. The analyst has already documented the server's listening ports and its normal user accounts. According to server profiling practices, which additional element should the analyst document to identify unauthorized or anomalous programs that may later run on the host?