Malware Analysis Report

2024-09-11 16:45

Sample ID 240614-qmxjcawdmm
Target FileCenterSetup12.0.16.0.exe
SHA256 df2b7f274c484ae5baecb3365b1d9fcc4821facf327ce87724b1be597d0c70a9
Tags
vidar discovery persistence stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

df2b7f274c484ae5baecb3365b1d9fcc4821facf327ce87724b1be597d0c70a9

Threat Level: Known bad

The file FileCenterSetup12.0.16.0.exe was found to be: Known bad.

Malicious Activity Summary

vidar discovery persistence stealer

Vidar

Enumerates connected drives

Drops desktop.ini file(s)

Blocklisted process makes network request

Adds Run key to start application

Drops file in System32 directory

Checks computer location settings

Drops file in Program Files directory

Registers COM server for autorun

Loads dropped DLL

Executes dropped EXE

Checks installed software on the system

Drops file in Windows directory

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Checks SCSI registry key(s)

Suspicious behavior: SetClipboardViewer

Modifies Internet Explorer settings

Uses Volume Shadow Copy service COM API

Checks processor information in registry

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Kills process with taskkill

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SendNotifyMessage

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 13:24

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 13:23

Reported

2024-06-14 13:58

Platform

win10v2004-20240226-en

Max time kernel

607s

Max time network

609s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

Signatures

Vidar

stealer vidar

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileCenterAgent = "C:\\Program Files (x86)\\FileCenter\\Main\\FileCenterAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileCenterAutomateAgent = "C:\\Program Files (x86)\\FileCenter\\Main\\FileCenterAutomateAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{3780ab31-c524-4f3b-a4db-79d692700a62} = "\"C:\\ProgramData\\Package Cache\\{3780ab31-c524-4f3b-a4db-79d692700a62}\\PDFXLite10.exe\" /burn.runonce" C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Windows\System32\MsiExec.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\{1BFDA561-028C-4743-BA01-3E4C4E84863B}\.cr\PDFXLite10.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\DRIVERS\x64\pxcdrv.xml C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File opened for modification C:\Windows\system32\spool\DRIVERS\x64\pxcdrvL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\pxc50pm.dll C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\PXC50f.DLL C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File created C:\Windows\system32\pxcpmL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\pxcdrvL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File opened for modification C:\Windows\system32\pxc50pm.dll C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\PXC50UIf.DLL C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File opened for modification C:\Windows\system32\pxcpmL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\iristestapp.exe C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-OFSJJ.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterOCREngineGD.exe C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\secman.dll.log C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterAdmin.exe C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\ocrdll.dll C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\ISYSreadershd.dll C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-P8NF0.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-4P25Q.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-4MNAG.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Tracker Software\Update\TrackerUpdate.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.ko-KR.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-8BE73.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterAgent32.dll C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-VQKCC.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.uk-UA.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrskrn15.dll C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\Separators.exe C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-M576U.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-SOFM9.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-77N1E.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\Plugins.x86\FowpKbd.dll C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-BPF0O.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.fr-FR.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterOCREngineTR.exe C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-UJJNJ.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Help\is-E7FQJ.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-713UH.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-5FMSJ.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.sl-SI.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.lt-LT.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterThumbs.exe C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\Eztwain4.dll C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-5CGTO.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\GdOCR\is-ID5N3.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Help\is-0NS2U.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\Temp\win32\is-3QT5Q.tmp C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\dscrt40.dll C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Help\is-ABMGH.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\Temp\win32\PXC50pm.dll C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\Temp\x64\PXC50uif.dll C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.hu-HU.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-UORVG.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-NA3AI.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-3V1O5.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.id-ID.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\pxcdrv.xml C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-2J3NS.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-NP473.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-URAE3.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-ORLRS.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-9D65J.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-VTNUN.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-Q572F.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.lt-LT.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-EBO92.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.fr-FR.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.Imaging.ML.dll C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\x64\pxcdrvL.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateAgentEx.exe C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\GdOCR\is-68P6A.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-Q1J59.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-5JT93.tmp C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE125.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE1C2.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE1E3.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE261.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE2FF.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE5FD.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5bd969.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE2B0.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{6318D993-1BE8-4BE4-B9E9-D6BFED11A071} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIEEF8.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF4A6.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5bd965.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{6318D993-1BE8-4BE4-B9E9-D6BFED11A071}\AppIco C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF592.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5bd965.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE6CA.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{6318D993-1BE8-4BE4-B9E9-D6BFED11A071}\AppIco C:\Windows\system32\msiexec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Windows\Temp\{113DBC75-0AA0-408C-815A-6344A1A44D1F}\.cr\vc_redist.x86.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe N/A
N/A N/A C:\Windows\Temp\{1BFDA561-028C-4743-BA01-3E4C4E84863B}\.cr\PDFXLite10.exe N/A
N/A N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\Temp\{113DBC75-0AA0-408C-815A-6344A1A44D1F}\.cr\vc_redist.x86.exe N/A
N/A N/A C:\Windows\Temp\{1BFDA561-028C-4743-BA01-3E4C4E84863B}\.cr\PDFXLite10.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Windows\splwow64.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CC0D923-B9ED-310C-B453-D1A59F25712C}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32\ = "mscoree.dll" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{718C8EE7-1EEF-4717-8E60-C3661B610550}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBED514A-A877-398F-AE2A-A1EDE5F43724}\InprocServer32\ = "mscoree.dll" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBED514A-A877-398F-AE2A-A1EDE5F43724}\InprocServer32\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CC0D923-B9ED-310C-B453-D1A59F25712C}\InprocServer32\Class = "GdPicture14.GdViewer" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F656181-7551-47DC-8A8A-7BB562F91A6F}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{732C85A4-B68F-4D3F-920A-B13DB0BDC9C8}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{51DE5D08-F43E-386D-AE8D-9A8EEF3C7B60}\InprocServer32\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F656181-7551-47DC-8A8A-7BB562F91A6F}\InprocServer32\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32\Class = "GdPicture14.Imaging.GdPictureRectangleF" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A46B9230-3A18-3180-9BA9-1D063B9DB1B7}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4813FAB2-FDF6-3ACA-8C00-511671D1214B}\InprocServer32\Class = "GdPicture14.GdPictureOCR" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6BA216B3-0CCA-39E5-B68B-F4F943B65D9D}\InprocServer32\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9E52549-FC4C-33F9-99DE-61302E5F2E47}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6835517-900C-37F4-B861-936E79F91A48}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{51DE5D08-F43E-386D-AE8D-9A8EEF3C7B60}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBED514A-A877-398F-AE2A-A1EDE5F43724}\InprocServer32\Class = "GdPicture14.ThumbnailEx" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{718C8EE7-1EEF-4717-8E60-C3661B610550}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CC0D923-B9ED-310C-B453-D1A59F25712C}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{732C85A4-B68F-4D3F-920A-B13DB0BDC9C8}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CC0D923-B9ED-310C-B453-D1A59F25712C}\InprocServer32\ = "C:\\Windows\\system32\\mscoree.dll" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DF179B8-96F1-4F3E-9338-DFEEB61B810A}\LocalServer32\ = "\"C:\\Program Files\\Tracker Software\\Update\\TrackerUpdate.exe\"" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AFC06F6-7848-37B5-8044-97A2EBECF8BB}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9E52549-FC4C-33F9-99DE-61302E5F2E47}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{732C85A4-B68F-4D3F-920A-B13DB0BDC9C8}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CC0D923-B9ED-310C-B453-D1A59F25712C}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AFC06F6-7848-37B5-8044-97A2EBECF8BB}\InprocServer32\ = "mscoree.dll" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9E52549-FC4C-33F9-99DE-61302E5F2E47}\InprocServer32\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBED514A-A877-398F-AE2A-A1EDE5F43724}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6835517-900C-37F4-B861-936E79F91A48}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{51DE5D08-F43E-386D-AE8D-9A8EEF3C7B60}\InprocServer32\14.2.69.0\Class = "GdPicture14.LicenseManager" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6BA216B3-0CCA-39E5-B68B-F4F943B65D9D}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CBD34A5D-CCD7-47B5-B8D4-121D40FA0934}\InprocServer32\Class = "GdPicture14.GdPictureOCR+SpreadsheetOptions" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4813FAB2-FDF6-3ACA-8C00-511671D1214B}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CEB68BB-FEF5-3F6C-9F82-7C6B1F524A3F}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AFC06F6-7848-37B5-8044-97A2EBECF8BB}\InprocServer32\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6BA216B3-0CCA-39E5-B68B-F4F943B65D9D}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4813FAB2-FDF6-3ACA-8C00-511671D1214B}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{732C85A4-B68F-4D3F-920A-B13DB0BDC9C8}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AFC06F6-7848-37B5-8044-97A2EBECF8BB}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AFC06F6-7848-37B5-8044-97A2EBECF8BB}\InprocServer32\ = "C:\\Windows\\system32\\mscoree.dll" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6835517-900C-37F4-B861-936E79F91A48}\InprocServer32\Class = "GdPicture14.AnnotationManager" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{732C85A4-B68F-4D3F-920A-B13DB0BDC9C8}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{51DE5D08-F43E-386D-AE8D-9A8EEF3C7B60}\InprocServer32\Class = "GdPicture14.LicenseManager" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{021BDF87-EEFB-4384-9183-F8170E3DC459}\InprocServer32\ = "C:\\PROGRA~2\\FILECE~1\\Main\\FILECE~4.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A46B9230-3A18-3180-9BA9-1D063B9DB1B7}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{732C85A4-B68F-4D3F-920A-B13DB0BDC9C8}\InprocServer32\Class = "GdPicture14.GdPicturePDFReducer" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CEB68BB-FEF5-3F6C-9F82-7C6B1F524A3F}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6BA216B3-0CCA-39E5-B68B-F4F943B65D9D}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A46B9230-3A18-3180-9BA9-1D063B9DB1B7}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24DFB749-780D-41B4-9BE3-8894D202B944}\LocalServer32\ = "\"C:\\Program Files (x86)\\FileCenter\\Drivers\\PDF-XChange 5\\pdfSaver5.exe\"" C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D8DD4B1-B719-303C-8F01-7C00B4A93B1F}\InprocServer32\Class = "GdPicture14.GdPictureSegmenter" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F656181-7551-47DC-8A8A-7BB562F91A6F}\InprocServer32\14.2.69.0\Class = "GdPicture14.PDFReducerConfiguration" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CEB68BB-FEF5-3F6C-9F82-7C6B1F524A3F}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CEB68BB-FEF5-3F6C-9F82-7C6B1F524A3F}\InprocServer32\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Program Files (x86)\FileCenter\Main\FileCenter.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064efbbd21686319b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000064efbbd20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090064efbbd2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d64efbbd2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000064efbbd200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\AppPath = "C:\\Program Files (x86)\\FileCenter\\Drivers\\PDF-XChange 5\\" C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\AppName = "C:\\Program Files\\Tracker Software\\PDF-XChange Lite\\pdfSaverL.exe" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\AppPath = "C:\\Program Files\\Tracker Software\\PDF-XChange Lite\\" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\Policy = "3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40} C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\AppName = "pdfSaver5.exe" C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{572B1557-5AAB-4A36-99D4-3BEC5AD538E8}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AFC06F6-7848-37B5-8044-97A2EBECF8BB}\ProgId\ = "GdPicture14.BookmarksTree" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{332B999A-7A54-3E85-86FC-417F6BBB604B}\14.2.69.0\Class = "GdPicture14.DocumentFormat" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EBB31E2-2E6A-4463-B53B-EA7C502D564D} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B27E7FF-6279-49DA-AE6B-8E13AD665B1F}\ = "IPXV_DocContentsChangesInfo" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45BF8A5F-296C-44D4-9DB4-E04F04EF501B}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3EDEE1C3-AA36-4DAA-8C8E-58AAD6EEC086}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F7817FE-ED49-4111-A10D-B187262CF499}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D63F369-74F5-4C4B-A203-B68374F6A35A}\ = "IPdfOcrOptions" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{553CF597-98AA-41A3-B2F0-9C6101A6DFA6}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{87B7522A-0E70-3527-85B7-1941F36D955D}\14.2.69.0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VintaSoft.Twain\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E920A0D-3156-4EB6-932F-5AB7287C54E5}\ = "IAFS_FileInfo" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3405AD2D-C01C-4EE7-B551-5613AABFEFF2}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{29ABE265-6CDB-3D02-B577-CA01A9859877}\14.2.69.0\Class = "GdPicture14.BarcodeQRErrorCorrectionLevel" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD74E532-D113-3F50-A247-49926E0C6476}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CD00BD8-331B-42A2-AEFB-B5F031FD69A1}\ = "IPXV_DocHighlighter" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59E2C36F-1CC9-3991-A780-6C6A3CD4A19B}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9ED66FF9-6C60-4DCF-8D1C-289DF0530203}\1.0 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dtSearchEngine6.SearchFilter\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91F594C1-7C1A-465D-BC9C-004E2FD7C6C4}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE4EB426-7321-3D5B-A255-694F9D887551}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697DF02B-B24E-11D3-B57C-00105AA461D0}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{2CB39873-DF95-333A-B652-AB54100BD735}\14.2.69.0\Class = "GdPicture14.JPEGSubsamplingMode" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1491043E-1B4D-489D-BED8-B9E2E7598289}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{058487BC-FAB1-43E1-B9E0-77E7ADB97460} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1218E839-61FD-3234-93D1-73E6C31AD60A}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BB0EB1C-DFE1-3939-85FE-856BEA15B1E4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\399D81368EB14EB49B9E6DFBDE110A17\F_Langs_Lite = "F_Lite" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dten600.SearchReportJob\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53D6E3DD-6F2C-45BC-8B43-D74267B6BBB8}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C341E89-9DC0-4DDA-94D1-BE06A410FC14} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7A9134A9-20F7-4D8D-806D-8DEFDF70029F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35A751A3-6421-43CE-A2C3-AF90882A8875}\ = "IPXV_JSCodeSnippet" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{AF425CA2-C562-3E1D-BD8E-828B8C9001C8}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{063E51BB-4D88-3B05-9A50-D54BE70E6F64}\ = "_PdfUriNavigationEventHandler" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F656181-7551-47DC-8A8A-7BB562F91A6F}\InprocServer32\Class = "GdPicture14.PDFReducerConfiguration" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7561F214-CA2F-42C9-8F44-1110FCDA066D}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1987CCA-CF31-47CE-932A-A19A07AFBAB2}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DA36BE4-B5F2-4B33-9D8C-72593FEBDF99}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{999A6C12-A602-4601-9866-0B9AE973B7F2}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DEF6A2E-AE0C-33DB-907D-F5C2153DE192}\ = "_AnnotationStartEditingTextEventHandler" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4D21B431-2728-3565-A787-3C70DDC02DA2}\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CEB68BB-FEF5-3F6C-9F82-7C6B1F524A3F}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF8C36AE-BC94-3E40-BD5D-BEB08AB16C86}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F6F77C6-6570-3583-B9E4-95C1551B0455}\TypeLib\ = "{B5893B58-701E-4110-9871-1DA14CF9C1DC}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6D77AEE3-C66A-3FE4-B95C-498B3A8A24AF}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4C97D10F-0238-32CC-BF24-A216C47DA1AE}\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697DF028-B24E-11D3-B57C-00105AA461D0}\ = "ISearchReportJob" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72D158D4-EAF7-4894-A5FA-719C705800EB}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{092DCFE6-4B0E-4392-A71A-137E9F5DBF17}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FileCenter C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A31C9941-4A55-43F6-87BC-0738234B5CAB}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{092DCFE6-4B0E-4392-A71A-137E9F5DBF17}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77FC3DBC-DB44-48C6-AC03-51E54646A4D9}\ = "IUIX_ComboButton" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F116EDB3-E0C6-33ED-BF83-5558D696E73E}\14.2.69.0\Class = "GdPicture14.PdfCheckBoxStyle" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FBF7619D-DEB5-4F9E-9E15-3F26E28028AE}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\ProgId\ = "GdPicture14.Imaging.GdPictureRectangleF" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{655F7BC8-243D-3C01-BB76-AF67553FF501}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CEB68BB-FEF5-3F6C-9F82-7C6B1F524A3F}\Version C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B49BC40E-9DA8-39EA-B326-2FED8F629A16}\14.2.69.0\Class = "GdPicture14.PdfAnnotationFlag" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XCVault\ = "PDF-XChange Vault File" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{816CDC47-C3A9-4671-A17C-790D90CD38E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{374870A4-B4C3-45F6-8253-4E880ECD9B61} C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5092 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp
PID 5092 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp
PID 5092 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp
PID 5004 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 5004 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 5004 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 5004 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 5004 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 5004 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 5004 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 5004 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 5004 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 3440 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3440 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 5004 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 5004 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 5004 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe
PID 4752 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4752 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 5004 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe
PID 5004 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe
PID 5004 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe
PID 4924 wrote to memory of 2732 N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4924 wrote to memory of 2732 N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4924 wrote to memory of 2732 N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4924 wrote to memory of 4284 N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe

"C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp

"C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp" /SL5="$40160,314098152,831488,C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe" -S -INFO "-1" "3" "11" "C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtilsInfo.ini"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe" -S -INFO "-1" "3" "11" "C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtilsInfo.ini"

C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe" -CLOSEALL

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterPortal.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReceipts.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReports.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileAgent.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe" -INSTBEG

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterPortal.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReceipts.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReports.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileAgent.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -INSTEND

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\PDFXEditCore.x86.dll"

C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe

"C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe" /silent

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\dten600.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\lbvProt.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\VSTwain.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\secman.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.dll"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" /s "C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll" /codebase /tlb

C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe

"C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe" /install /quiet /norestart

C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe" /install /silent

C:\Windows\Temp\{113DBC75-0AA0-408C-815A-6344A1A44D1F}\.cr\vc_redist.x86.exe

"C:\Windows\Temp\{113DBC75-0AA0-408C-815A-6344A1A44D1F}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=560 /install /quiet /norestart

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -PRINTER

C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe" /quiet /norestart /log "C:\ProgramData\FileCenter\PDFPrinterLog.txt" PNAME="FileCenter PDF Printer" ORGANIZATION="FileCenter"

C:\Windows\Temp\{1BFDA561-028C-4743-BA01-3E4C4E84863B}\.cr\PDFXLite10.exe

"C:\Windows\Temp\{1BFDA561-028C-4743-BA01-3E4C4E84863B}\.cr\PDFXLite10.exe" -burn.clean.room="C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /quiet /norestart /log "C:\ProgramData\FileCenter\PDFPrinterLog.txt" PNAME="FileCenter PDF Printer" ORGANIZATION="FileCenter"

C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe

"C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.be\PDFXLite10.exe" -q -burn.elevated BurnPipe.{265804FB-A38A-49DF-81ED-60CD89EE597F} {AEEEDDDC-4671-4BA9-8314-5D11EB8B2021} 5056

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" /s "C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll" /codebase /tlb:GdPicture.NET.14.64.tlb

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -DRIVER

C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe" /VERYSILENT /NORESTART /NOICONS /COMPONENTS="pdfSaver,PDFXChangedriver" /DIR="C:\Program Files (x86)\FileCenter\Drivers\" /PName="XChange Internal Driver" "/Organization:FileCenter" /LOG="C:\ProgramData\FileCenter\PDFDriverLog.txt"

C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp

"C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp" /SL5="$70294,5384545,119296,C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe" /VERYSILENT /NORESTART /NOICONS /COMPONENTS="pdfSaver,PDFXChangedriver" /DIR="C:\Program Files (x86)\FileCenter\Drivers\" /PName="XChange Internal Driver" "/Organization:FileCenter" /LOG="C:\ProgramData\FileCenter\PDFDriverLog.txt"

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe" /W0 /I /N:"XChange Internal Driver" /Base:"PDF-XChange "

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe" /RegServer

C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe

"C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe" /install

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding E989E6B221CA97D859DC0F2C367ACDEF

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding AF8DD5165E626B6B1A943A8D9A8D2A22 E Global\MSI0000

C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\\PrnInstaller.exe" /L /I_D_R_M_P /F /N "FileCenter PDF Printer"

C:\Program Files (x86)\FileCenter\Main\FileCenter.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenter.exe"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "FileCenter PDF Printer"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "PDF-XChange Lite"

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -OLOFF

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.filecenter.com/action.php?Action=Welcome&Refresh=1&ProductKey=&KeyID=-1&PTID=1&SourceID=-1&CustomID=-1&VerID=-1&PartnerID=0&WelcomeID=0&Version=12.0.16.0&CN=OAILVCNY&UN=Admin&Trial=0&DaysLeft=0&s=&cnt1=&cnt2=&cnt3=&cnt4=&cnt5=&cnt6=&cnt7=&cnt8=&cnt9=&x=1235

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3856 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:1

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=5204 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5412 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:1

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5484 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe"

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx" /o ""

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5892 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=3888 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x150 0x4f8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3876 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5596 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe" 3172

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x214,0x25c,0x7ffadb592e98,0x7ffadb592ea4,0x7ffadb592eb0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2316 --field-trial-handle=2320,i,1482318864424202595,14026145864776017630,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2600 --field-trial-handle=2320,i,1482318864424202595,14026145864776017630,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2680 --field-trial-handle=2320,i,1482318864424202595,14026145864776017630,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4496 --field-trial-handle=2320,i,1482318864424202595,14026145864776017630,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4496 --field-trial-handle=2320,i,1482318864424202595,14026145864776017630,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3172 -ip 3172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4552 --field-trial-handle=2320,i,1482318864424202595,14026145864776017630,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4680 --field-trial-handle=2320,i,1482318864424202595,14026145864776017630,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4540 --field-trial-handle=2320,i,1482318864424202595,14026145864776017630,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4728 --field-trial-handle=2320,i,1482318864424202595,14026145864776017630,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 21.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 23.23.48.23.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.187.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 16.43.107.13.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 www.filecenter.com udp
US 8.8.8.8:53 www.filecenter.com udp
US 8.8.8.8:53 www.filecenter.com udp
US 98.129.229.7:80 www.filecenter.com tcp
US 98.129.229.7:80 www.filecenter.com tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 www.filecenter.com udp
US 8.8.8.8:53 www.filecenter.com udp
US 8.8.8.8:53 www.filecenter.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 172.165.69.228:443 nav-edge.smartscreen.microsoft.com tcp
GB 172.165.69.228:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 7.229.129.98.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
SE 23.34.233.128:443 www.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 www.filecenter.com udp
US 8.8.8.8:53 www.filecenter.com udp
US 13.107.6.158:443 business.bing.com tcp
US 98.129.229.7:443 www.filecenter.com tcp
US 8.8.8.8:53 128.233.34.23.in-addr.arpa udp
US 8.8.8.8:53 228.69.165.172.in-addr.arpa udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 158.6.107.13.in-addr.arpa udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
NL 104.97.14.88:443 bzib.nelreports.net tcp
NL 104.97.14.88:443 bzib.nelreports.net tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 assets.filecenter.com udp
US 8.8.8.8:53 assets.filecenter.com udp
US 8.8.8.8:53 ws.zoominfo.com udp
US 8.8.8.8:53 ws.zoominfo.com udp
US 8.8.8.8:53 assets.calendly.com udp
US 8.8.8.8:53 assets.calendly.com udp
US 8.8.8.8:53 calendly.com udp
US 8.8.8.8:53 calendly.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 code.jquery.com udp
US 151.101.66.137:443 code.jquery.com tcp
US 172.64.146.81:443 calendly.com tcp
US 104.18.41.175:443 calendly.com tcp
US 104.16.118.43:443 ws.zoominfo.com tcp
US 8.8.8.8:53 88.14.97.104.in-addr.arpa udp
US 98.129.229.7:443 assets.filecenter.com tcp
US 98.129.229.7:443 assets.filecenter.com tcp
US 98.129.229.7:443 assets.filecenter.com tcp
US 98.129.229.7:443 assets.filecenter.com tcp
US 98.129.229.7:443 assets.filecenter.com tcp
US 98.129.229.7:443 assets.filecenter.com tcp
US 8.8.8.8:53 static.zdassets.com udp
US 8.8.8.8:53 static.zdassets.com udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 137.66.101.151.in-addr.arpa udp
US 8.8.8.8:53 104.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 81.146.64.172.in-addr.arpa udp
US 8.8.8.8:53 175.41.18.104.in-addr.arpa udp
US 8.8.8.8:53 43.118.16.104.in-addr.arpa udp
US 104.18.70.113:443 static.zdassets.com tcp
US 8.8.8.8:53 static.hotjar.com udp
US 8.8.8.8:53 static.hotjar.com udp
US 8.8.8.8:53 bat.bing.com udp
US 8.8.8.8:53 bat.bing.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 connect.facebook.net udp
GB 18.165.160.39:443 static.hotjar.com tcp
US 204.79.197.237:443 bat.bing.com tcp
BE 88.221.83.218:443 www.bing.com tcp
GB 163.70.147.23:443 connect.facebook.net tcp
US 8.8.8.8:53 113.70.18.104.in-addr.arpa udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
GB 18.165.160.39:443 static.hotjar.com tcp
US 204.79.197.237:443 bat.bing.com tcp
BE 88.221.83.218:443 www.bing.com tcp
GB 163.70.147.23:443 connect.facebook.net tcp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 39.160.165.18.in-addr.arpa udp
US 8.8.8.8:53 218.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 64.253.107.13.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.42.73.29:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 29.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 216.58.201.98:443 googleads.g.doubleclick.net udp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 ekr.zdassets.com udp
US 8.8.8.8:53 ekr.zdassets.com udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 104.18.72.113:443 ekr.zdassets.com tcp
US 216.239.34.36:443 region1.analytics.google.com tcp
BE 108.177.15.156:443 stats.g.doubleclick.net tcp
GB 163.70.147.23:443 connect.facebook.net udp
US 8.8.8.8:53 98.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 113.72.18.104.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 8.8.8.8:53 www.google.co.uk udp
US 8.8.8.8:53 www.google.co.uk udp
US 8.8.8.8:53 script.hotjar.com udp
US 8.8.8.8:53 script.hotjar.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.3:443 www.google.co.uk udp
GB 142.250.187.196:443 www.google.com udp
GB 54.230.10.10:443 script.hotjar.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.147.35:443 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com udp
US 98.129.229.7:443 www.filecenter.com tcp
US 8.8.8.8:53 156.15.177.108.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.10.230.54.in-addr.arpa udp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 lucion.zendesk.com udp
US 8.8.8.8:53 lucion.zendesk.com udp
US 104.16.53.111:443 lucion.zendesk.com tcp
US 8.8.8.8:53 widget-mediator.zopim.com udp
US 8.8.8.8:53 widget-mediator.zopim.com udp
IE 52.18.105.179:443 widget-mediator.zopim.com tcp
US 8.8.8.8:53 111.53.16.104.in-addr.arpa udp
US 8.8.8.8:53 179.105.18.52.in-addr.arpa udp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.filecenter.com udp
US 98.129.229.7:443 www.filecenter.com tcp
US 98.129.229.7:443 www.filecenter.com tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 104.16.118.43:443 ws.zoominfo.com udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 bat.bing.com udp
US 8.8.8.8:53 bat.bing.com udp
GB 142.250.200.3:443 www.google.co.uk udp
US 216.239.34.36:443 region1.analytics.google.com udp
US 8.8.8.8:53 update.googleapis.com udp
US 8.8.8.8:53 update.googleapis.com udp
US 8.8.8.8:53 edge-mobile-static.azureedge.net udp
US 8.8.8.8:53 edge-mobile-static.azureedge.net udp
GB 216.58.204.67:443 update.googleapis.com tcp
US 13.107.246.64:443 edge-mobile-static.azureedge.net tcp
GB 216.58.204.67:443 update.googleapis.com udp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 13.107.253.64:443 edge-consumer-static.azureedge.net tcp

Files

memory/5092-0-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/5092-2-0x0000000000401000-0x00000000004B7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-K2N6K.tmp\FileCenterSetup12.0.16.0.tmp

MD5 0acf3c16e6faca9c0aec525f53d03866
SHA1 5c3960b48d2b72ad02e59470d8a7b690ee826f9e
SHA256 2c470730bf3efa3f4a9dc184548abefbab8c4aecc43e14834c5810159019c151
SHA512 17d98a3b52eb89e02a371f1d6effa59f624696cd14b0589fe436640ddbe04fc6c5d82834f73699dbaa32a7a69343f82863820e72e225e17d710c4de5102b46c2

memory/5004-6-0x0000000000400000-0x000000000071A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-C5VVJ.tmp\FileCenterUtils.exe

MD5 e9638374a27160513f1a62827b6cf102
SHA1 b9da58896020d46c4ef16f8f1b332d5f6c1e6f0f
SHA256 c064ba394872e6a8277a5c71b50da34b800d682e403c6b80ec3ba37badf38942
SHA512 9632c8416f542dc96f22a0ddcd109e85c29368b1263d86f74bab39aae8e9271a7b3e2eea18932cf4e3fb5e269d3892016b878d29fb6dad002db11367849f293c

memory/4584-12-0x0000000003650000-0x0000000003651000-memory.dmp

memory/4584-13-0x0000000000610000-0x00000000010A6000-memory.dmp

memory/5092-14-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/5004-15-0x0000000000400000-0x000000000071A000-memory.dmp

memory/5004-17-0x0000000000400000-0x000000000071A000-memory.dmp

memory/1068-19-0x0000000000610000-0x00000000010A6000-memory.dmp

memory/5004-21-0x0000000000400000-0x000000000071A000-memory.dmp

memory/3440-23-0x0000000000610000-0x00000000010A6000-memory.dmp

memory/4752-25-0x0000000000610000-0x00000000010A6000-memory.dmp

memory/5004-36-0x0000000000400000-0x000000000071A000-memory.dmp

memory/5004-52-0x0000000000400000-0x000000000071A000-memory.dmp

memory/5004-136-0x0000000000400000-0x000000000071A000-memory.dmp

memory/5004-314-0x0000000000400000-0x000000000071A000-memory.dmp

memory/5004-430-0x0000000000400000-0x000000000071A000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\FileCenter.exe

MD5 879d5b401a73cc57a3166ba01ce70c60
SHA1 ee8b47af48514a3b65f4ee838c95e7a3a64d3434
SHA256 82da544c9d730c17c34a253c29fd7d621e8cdc064e0220c27e43bb0dd60c4ebe
SHA512 6e49343acca8ab878b4cf9e12ce4d796decd7f44c7068f8d90f5ad2eebbab31c15c82bbf66bcb571120a9bf8e375055558308d00b66053591c6ec94fb514b3b6

memory/5004-556-0x0000000000400000-0x000000000071A000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe

MD5 b9718823c993fccb6352cc0210993569
SHA1 4d551f7cafd0040ff9657ca644c1365f3e7847ae
SHA256 a173ba320929c93b9bf41186a0692d753da812b8691dcc416c16abdf004dbf89
SHA512 6e513ef7535539cff90e88b95c5f57bb9e262cebbf1e51bc8268595347fbf06f628cf16eaa974d7eccd2a285ff2f8f56867c4292c1fe4fb7b0ee90f5acee9747

C:\Program Files (x86)\FileCenter\Main\dten600.dll

MD5 22cf875a0cf0ad89f5f7d7ac6628a598
SHA1 c2a9620579a08d6a91557e6cb8f1d2585392d30d
SHA256 11ef1b8791cfd8fee0923ec685ae1d29485349ce7d2d37a15ae1615e8d646baf
SHA512 3b59898730a9eb4a8f4347b8c854983636b28f6641b072fdd0d7f9190b905fc9b03dcf204154072048dc1a6a24785d2aead865b5bf160c9af9df87cf4175c608

C:\Program Files (x86)\FileCenter\Main\lbvProt.dll

MD5 120387e48d0556538ef3ee68de18a707
SHA1 0633de57f7ef851115be39d407db8e08986b3d93
SHA256 e202172ad8799ee0feee2559ac06f2cf75530f702f7e11d0cb4c1b3ec57eae4e
SHA512 a7509c2822bd7f08b5e67dfbd3d9ac701639599b5681966f5276f51e60608dcd7dafaa953f7589d99de7ba7b68eaa56be0ecb2c074f5c4ba6ba114880507b1da

C:\Program Files (x86)\FileCenter\Main\VSTwain.dll

MD5 13f5f7e228ce2b8a3a41dbad4e451279
SHA1 1b3837572602b2620b75bf2ad2aeab89a64f5287
SHA256 11b50ff0bc4e72cd2dd47fb8070a86781682b92a9fb1010a5fae97276afb2292
SHA512 24ea8072abb5c0d4083989539f399ad076cc92260aaf0317320dddb4196e752e1c082d386c75049a343b1c62765d587f2b66374b53e7b24326ee6129a7aa856d

memory/548-567-0x0000000010000000-0x00000000101C8000-memory.dmp

memory/4284-570-0x0000000000460000-0x0000000000468000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\secman.dll

MD5 085d87f49daf13496e0e018c4008fae6
SHA1 4b0c3058b8ace7e8242c941b449daa968f5b45c7
SHA256 d1f1e3717a68166942d1f7a71b78e35e3381edbb07d7d37ae8b603dcc3ffad15
SHA512 52886de13e538e0eef364a16da1ccd24a571450d417ead4ddb689efe8e8099f9964c5f6076a239e833bd41c88f2f95f30c20d722f880837aa541be366407145b

C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.dll

MD5 2b9bbd88d6b6a3b7c417cbb0eae69bf4
SHA1 c43ab9fa5c1085ba21280d143f8b8322d6a93883
SHA256 1e5f8dbd4c08faf3a0a84b6af17454d9d21459618b411696b9604af80ee9fc0f
SHA512 f07ae3e76066960a3b657146b83da724ca13873edd82d7314d048593c3e6021ced3297459d46a30daf95189631bfd4c941e44d91433549dcc70efb5407543a30

C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.ini

MD5 70da425f8aac14b1484047edb83e60e8
SHA1 69d09199af5a5ba4ed4e1d59432fec784d5271e4
SHA256 258d4ad31457b1c117b248b6ba0dd1c44ba6ad0a0839623ced45ce15ebbd0a7f
SHA512 a9cf352b79a8f38f03a781bf55a94e2c1344e1de55e9ea21e736ad436d7452f8349a64fec3b46e7ddc1d11f5fa3ecc80329b5b4e1da702680e9c2223e57943d2

C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe

MD5 35b40b21383ac38487ceec8ab6e53565
SHA1 59894bd9c96361b475c3b4b7ca9719c72e813d04
SHA256 caa38fd474164a38ab47ac1755c8ccca5ccfacfa9a874f62609e6439924e87ec
SHA512 3a00b40ba8cd1cf8a523efab656f5b8910a3b07f9d8fba4ffc07745165b6375affd77b00fd3064fa72fb984c1773438a39e67a55363be23dd8fe1727c1016b8e

C:\ProgramData\FileCenter\Config.ini

MD5 b2ad8f8dcc45644ea167317d050faac4
SHA1 215091d6ad9d4f210b85e675b17c60a7300ca9b1
SHA256 9aaebe4ab06e9de08e28b9b4da9248442c502ef5411d7d734c13af1afa2c2dd0
SHA512 528737e85d799e0312c335bbbb856f12ee885465e9b999d6cfb1b64d8c003744a5a6d6cd7ae2b6e41b9cbe23115990acd65debfcdd15e1677c955944403da6f4

C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe

MD5 42d9ffbb0b7ef3cbdeb0c005619b12fb
SHA1 fbaed95c25aa26c43121e8421b5154e9e5dcdca0
SHA256 59e5b75c18c82acf2d94a1fd9b0a67af6795d594e1f837df1a80eec66671d307
SHA512 c77b91ca41b13bb471ced5346f998805430a33e210c09c0d7e0b0a7573d9e95da1bc5e351df08c871e1c3e962b3ec4b9fdb5ef5cc806fd87ef42f50ddd99d7cb

C:\Windows\Temp\{113DBC75-0AA0-408C-815A-6344A1A44D1F}\.cr\vc_redist.x86.exe

MD5 86123c033231dd7e427d619ddeefd26a
SHA1 608c085348fd9c4e124e6f28f0388ccdac6ab2b5
SHA256 d863fb2f65bb6eea492e79ab9d09a53cc226e85f57d6545cb82f60b122a4b737
SHA512 ffb574123b350d3c9434abc88baa050ae6e54b5b9ebf3f1dcf4bf079284135696004508653e74a3a3c2fa8e4c1b681c3f31d5fe69e0f0c5f45ed37f9ddc61e78

C:\Windows\Temp\{09323426-0890-414E-A8DB-514E58A07C2C}\.ba\wixstdba.dll

MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

memory/2220-628-0x00000000009B0000-0x000000000116B000-memory.dmp

memory/4924-627-0x0000000000400000-0x0000000000E96000-memory.dmp

C:\Windows\Temp\{09323426-0890-414E-A8DB-514E58A07C2C}\.ba\logo.png

MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe

MD5 4c61ee01d5b84db67c38c10d3f210f39
SHA1 844eab66505dc4eb88dec70c3f20307365c350ac
SHA256 a7e10bda5cb2e1c347b2ee682385fd56ff5da05c659c665abc0b526f639a5583
SHA512 a44a2bd871c9f0f654b0e627accc9d4388390e5e5b7326a3372a103886d74b89ab78e235e1b986da9acf0f08fdf45b642ec26000bbe32de92a44b1978f4c2f80

memory/4448-671-0x0000000000E70000-0x0000000000E82000-memory.dmp

C:\Windows\Temp\{1BFDA561-028C-4743-BA01-3E4C4E84863B}\.cr\PDFXLite10.exe

MD5 63ed90cdd501829a2319f8cf86c52bd2
SHA1 da198bec49015e98baa5b2cb91903f659e31dd37
SHA256 529bcd90e571d51a19396cb457bf7eebecf494613030389fa7c5b25b8e42757f
SHA512 d8cc05a5d481e17432125d21d58c2b32696c8b3e6632f911184292a0f0b24910e9dc5cc3ae2bdc6d87e478aef81504aa34520d3bd6813517e4b9347eee0eaa19

C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll

MD5 d9806fd0eeafd9f89e0473ad52889283
SHA1 d6fca558897aaa6703129557e2d02b1a84765dcb
SHA256 aa2aafe588aecd1a10bf05dcd675143061a55bcd5bc83bd749bde7b85d21dbc6
SHA512 796c609dc6fa4c6fe1e6909ae3a4a22cc06c900f34b999d77a9805767f69f1b1d96a99e9ee03ad6ab68e7f6bb5fa3269c1d73db4af68a2834bfd5cbf2fe91422

C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.ba\wixstdba.dll

MD5 0ba387d66175c20452de372f8dbb79fe
SHA1 5411d41a7d88291b97fb9573eb6448c72e773b70
SHA256 7b3d4a22a56cd80f19c48a321f978f728d34b8227cdc7fcadeb76b7506b2bb33
SHA512 13ec6e6ddc602e8053aadd4dd84ed87c23b581f2a41d738e32a522128ca4985dcfcaedc7fab192085f0eb4facd1cd7ad91ccaf8505491e29288d2f66cbf705fd

C:\Windows\Temp\{4DFBDBDE-C2E9-44AF-9323-A0359CE0B6B8}\.ba\logo.png

MD5 04967ef5107480ea36b3e2e97af7eb7a
SHA1 6efdd4484dcfcfd45b3c887c852f0abb1a02a645
SHA256 63f2616963b68ac13dab898c1b5938ab1b353a9ba0f73c6a2f2c3c5c9eac0b21
SHA512 00ae4cff10b1a6e504d590d49bc4af707ad33c1739ed46f648dc348645bd5d4b61bf0c84448c78d7542fb6d7294f3aa753b4106579f15b1d726bf1118594c581

memory/4448-700-0x0000000007FA0000-0x000000000A48A000-memory.dmp

memory/4448-711-0x0000000006250000-0x00000000067F4000-memory.dmp

memory/4448-712-0x0000000005DA0000-0x0000000005E32000-memory.dmp

memory/4448-714-0x0000000006100000-0x0000000006108000-memory.dmp

memory/4448-715-0x0000000006CA0000-0x0000000006CC2000-memory.dmp

memory/4272-717-0x0000000000400000-0x0000000000E96000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.tlb

MD5 6c685c23f81254eb11596036b5163e7f
SHA1 5ed5b5c3b1b759be2c4369b8b20332a34f60b6a7
SHA256 86d068d295c5153e48be22000ec414ba8590752c460c52f518ce856eba4d171a
SHA512 c0aaa42e2af8e6cd653eef56778346a9246d838f00a942cfb278bab46bcd9ba646e98cb3092e266f3471867f373d880865e9d93b7066a64ee25146dc8212cb26

memory/4288-721-0x000001DFB03E0000-0x000001DFB03F0000-memory.dmp

memory/4288-722-0x000001DFCCED0000-0x000001DFCF3BA000-memory.dmp

memory/4288-726-0x000001DFB0820000-0x000001DFB0828000-memory.dmp

memory/4288-727-0x000001DFCAAE0000-0x000001DFCAB02000-memory.dmp

memory/4272-734-0x0000000000400000-0x0000000000E96000-memory.dmp

C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe

MD5 1f3e8d034994c1b307d40b27b3d84e51
SHA1 0c33001c9e2f74d1156836991f66967fe90fbc89
SHA256 65a0b574b5c2787f0af118a1889ee093bd231e99f739de0ac27c2c6e67feb8e9
SHA512 730b07ac9aea78a93ff78cabb93fad3baf8e6e2ffcc5dac753e4d01dbf8ea662f3c1ca857b156db443a80904bd118ce20bbb037ba1f0e15b2038ce2fff8ca2c2

memory/4332-738-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1492-740-0x0000000000400000-0x0000000000E96000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-9FFQJ.tmp\PDFX5SA_sm.tmp

MD5 fa3f6d3bed7348ac3f45fde9e4ded1e4
SHA1 fdbf41b865e6a697142e8a2beb975ee728c41585
SHA256 3dbf88889ad9e347ac3fe93ec6f5d3771eff1fc2de39f8d7b3df9263a76b651e
SHA512 ed3d9fde7060b138b838ecc47969e601872b6a9541a39e24fbe7b56e1a68e414a93d9de187331d4dbf02430d4165c36ae2b167457e8ee90c59796ba7da972524

C:\Users\Admin\AppData\Local\Temp\is-8IS3J.tmp\InnoCA.dll

MD5 2fbf69d014ae135d473ec8243d44be9e
SHA1 2c28d3b23d8ff061ae554ccd92aec93900e3cb2b
SHA256 6f0d663f59487a01eebb128a9c4984789b91eaa764194ed9f0ed63583577d2d3
SHA512 530ab82b0ba1e148889bf41d6b00c67aee8ea4ff014b7e9d76bef682f8ce34a6908213b4d6f979ba02c6abe907cd1ac28bd323b4b766ede52b49ddd054d8b654

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\PrnInstaller.exe

MD5 06b201a00dea152f78b64658cce0bb7f
SHA1 134d858208cd2e0d981d37b4eb6378169ccd9faf
SHA256 64ddbaa42c6bd409c1f6326bf093396b7c8f4dc87abe72a859ad4ccd6ef84169
SHA512 e36d4cd90d10bceacdf512d611eb44805c038de7807352d0067bbbaecd1494c9a41b1c00309662370dff7792edf6b1f944c13485cb5395961f60b656e5ab9cfd

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\PrnInst.inf

MD5 8ff147219bd5e73ee33d00a248826775
SHA1 fda824e75be0518bae9f318260134018bbcb991f
SHA256 123e09cccecae500f862b07afde7de35fa611b281f46013def634bdb0f79a931
SHA512 9c141af1d8bd989478be8cf025432ddec8ebcf1616356b5eec9628e03403f1a91fa4d21446e5d637c1012b6f63e073d7d59c4620d878e4edb2269d6a6d96adf7

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\Temp\x64\pxc50pm.dll

MD5 f9d9240e668bb45601fb2702422351ec
SHA1 a7b67ca90f02ef9f1dfd76166e2d185f344da7cd
SHA256 02fdefe3d09c17e46c981418e941eb9f3df00634628b80f75e35494b9a6db83d
SHA512 7c3ebc8125f0bb47b2c319a2374ecb180b512a12638d8a28fcf303a76de89d787e6e2c78fc75380900c4596cfb643a88b6ca2e02f77f8751cddd8573e5b799dc

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\Temp\x64\PXC50UIf.DLL

MD5 935e6875d85a2edb94dcda06a7f2498d
SHA1 37fbd2cec8cb3c4744c7e5f6f1ad1a3b4c71895c
SHA256 72b99bb349d4092d0b4681cbec7fc635acecb1035e7ea794e06b4d5a27329bdd
SHA512 dcf23c81e62d11cf770c8bdeb904179b731ed813a0aeba2b4a15a8fd42662892cb3eeb8eb7b9effa76be8138ace398b670c6d8e8519c4b0b54baec513680a11a

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\Temp\x64\PXC50f.DLL

MD5 ae5251d1d87ca5e7297f3f79e5205425
SHA1 3c4788720a54c7701aadad76dff4884d9b6e87db
SHA256 d3dd2b36bc7d5b62f3225922b6748bb25e642d252486daf63af0e330e3ee45ca
SHA512 6e408278c4b4265d3a5853e90e599b377ca5492218979620f98c089fcb9e6f6dc54ce1023f2a013d78833b125978f645e36ed4340defd8446a40f3b3379b0b65

memory/5004-801-0x0000000000400000-0x000000000071A000-memory.dmp

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\DrvUI5.dll

MD5 226b45e8331f3b91c0266803cfb5a0f4
SHA1 e890becbbde5c3e0cae507ee9acff607047c619b
SHA256 2421844d17ab1a754d0663e15d19434e17ddb808386fe4be3840e5655cece426
SHA512 aa9c2c214fffeb46b215ffdc3d79422d4fed39bc7da57aec3e4e41e5114b594d5a0641f1fde68c207fcbd714561fffcee75afe55f17b3c6b8712dcb7632b513a

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe

MD5 ef2dcd7e7e8bd3883bba54075962b1c6
SHA1 6494e70909eac3eef4102cc5e6cabfa78e70a91c
SHA256 49e2ccd33057c4006349b2f5df9ef05b7bf35a9c467472a6bc439a4039325002
SHA512 f8d3001c53ae2f55125ee90cb886ef73e738dab2c63ef1c21b999ed8dc7fc6e742d4f86c17eeecf380e4b94c10094a69f529c0ff4ca4c59bef5518f71e71a57f

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.tlb

MD5 77810c050d6934d2254ec28aaff7f58f
SHA1 77b2f882f9f38e9ef805e7c6fde3a015f058282d
SHA256 dab7267aa157afb700f37af8f85e530d13d2960c868807b5505e515fcaffa29f
SHA512 06ece435c0df787b7b30f9502392b070cc7e48c891bfe2373b818b8cbfb2abcd08e76de927908b84851fb02aa752d004b9855c9da855add21298c3a3a85bf7fc

memory/2804-814-0x0000000000400000-0x000000000052C000-memory.dmp

memory/4332-815-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5004-818-0x0000000000400000-0x000000000071A000-memory.dmp

memory/5004-821-0x0000000000400000-0x000000000071A000-memory.dmp

memory/5092-822-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Windows\Installer\MSIE1E3.tmp

MD5 5a36339a5bae618a2ef09d0adab0b602
SHA1 437d251abdcfe4f9379c44336ff5b920df7a0fbf
SHA256 2e1d52eec9169247f75b584f874617ea4702cf2fdf92a4306d84c354a0151674
SHA512 cff119e5b719c8578d199b946fc213074d89195d63bf6cf00dc2c255cc66695d0062da2e916a22d4df4c1bb1e195f69df21c463d144ad9442defe7b3033ead2a

C:\Users\Admin\AppData\Local\Temp\prnInstaller.log

MD5 e29920a145ce5360712579de0515db77
SHA1 9b80e4f29bb3a1e00333e17cc22f3227c06966eb
SHA256 57e64ac57a2f8dd473fe57a05c5e03728892195bda3d12da48a1718bdc062c07
SHA512 c539d27b94628853761f69ce79fdaabf30a61099610fca06556c4651f8fd593ff26ac79a9d85d069d960b93f659e3e13077c877aaea7ef8a8ab537ec7dea7527

C:\Config.Msi\e5bd968.rbs

MD5 25106231907137b3f9f9aae3be2788b0
SHA1 3c97d288cd8e87a9f3f605ba172f127db314d46c
SHA256 705fd0037070681908ce780e84f31284452c4db2584ae6cadf0fc8c4070e8ca6
SHA512 1457b05388ccdb7152c4c449723605963b96ae4b96335050a381461dc106c7a51a521fe58e05c1ee1f2ad7338e95db5fb11edd77dabdadcf9aa8cc872a62a67b

C:\Windows\Installer\e5bd965.msi

MD5 e91e50fc80f7d84561db5823595e5b63
SHA1 b3e40b17a668586e86f346e9a7e3b8ef4838d437
SHA256 3203656dcafaf1ae128dae78bab26829bf0c2c9e1c255a8ca15ed176651d8948
SHA512 c9bb45c0882af7a2f5b6294fa2c29202ac529a6f1584e763a00c4812782f8274498a9c008ef0901dd67d895fd448e0eeb19a75cfe98bcd4c050c8856f97e5034

memory/3172-1054-0x0000000002050000-0x0000000002A89000-memory.dmp

C:\ProgramData\FileCenter\Settings\POLData_Lock.tmp

MD5 724deba0ee02aa7ad576295d784b1230
SHA1 f4f36556c9babc24a278f5f2ddcce4bff6a64bc7
SHA256 a98ebebe7123b54822d1250f6264dd8d971e47d5cc718fac967d2dd2374365ac
SHA512 3855cea9f71c3905baa510a42cf397da2b9f4f27cd071246e72911e646d6f5ba93fb120cb1a2f4d3e6a73d3d5ec40afc6dfbfb9e495e9bb9a2296930b1702239

C:\ProgramData\FileCenter\Config.ini

MD5 4a2b0b2d8d08db9fcc6eae2e25c9b4d1
SHA1 bcbd9242fe7ad0afabb143453d732657cfc79ede
SHA256 70bc9116d9db8cee6aaf87d19d323fc4961f90116b9a61281a981a461505974e
SHA512 5dc550410f15e4f64e637f61d8b6b09024b7502202ddd346463ac05b962d9bd6c3aecce6b85e089ca53184e99753cb2b137fae9ea26334d8044a0266742f6826

memory/3172-1145-0x0000000002050000-0x0000000002A89000-memory.dmp

memory/3172-1144-0x00000000001C0000-0x00000000017D8000-memory.dmp

memory/3172-1149-0x0000000002050000-0x0000000002A89000-memory.dmp

memory/3172-1148-0x00000000001C0000-0x00000000017D8000-memory.dmp

C:\ProgramData\FileCenter\MyPortal.ini

MD5 8af40c2a9db1af603163ed8b0e25a3d0
SHA1 36db1a9baec9e7d6d17073529afff9df063e68d9
SHA256 64b92b073e9519d07676100c694c63207f45b561ce66594b8728eae023ba0705
SHA512 2662a09e1cd148cbb4ee1124e4fdac6561699f447c986992651ff8fb8e7d005803b74ce5c1bb65c6f916ab1407894fabd453735c10378a94d5c918b1fe66688d

memory/4860-1158-0x0000000000400000-0x0000000000E96000-memory.dmp

memory/3172-1159-0x00000000001C0000-0x00000000017D8000-memory.dmp

memory/2408-1161-0x0000000002940000-0x0000000003379000-memory.dmp

memory/2408-1186-0x0000000002940000-0x0000000003379000-memory.dmp

memory/2408-1185-0x0000000000FB0000-0x00000000023F6000-memory.dmp

memory/3172-1190-0x00000000001C0000-0x00000000017D8000-memory.dmp

C:\ProgramData\FileCenter\Intercepts.ini

MD5 293bfe23c32bd1332e4caf09e9bb347d
SHA1 1777f80e58dcc9b37cf87d73a4680723c7b87461
SHA256 3f6dd37419d2c2075812e0a104d0603d78a5cf1b378154e8d71c30c37de84264
SHA512 0ec00fc8b45d2fa205be404a37546772919f891d439e336dd601c0961355dd9afdbae983c254a9760207ea15b7b446b7b9d90ad93f7b938aeb74e838204be194

C:\ProgramData\FileCenter\Logs\Hooks_Last.txt

MD5 59239ef825ec76a76906888f566366b7
SHA1 bfc9f4f70323693d88713e82f70fa006ba9e3fab
SHA256 9808e4fa0f09f782b937a3204f861afcd1b2dcaa08d813edb264513ba6513b90
SHA512 8752781f8e553ebee28c5db557fc1ae5ad39938efdd77fb063e7c2c51c904fb80b1f61e443d232d4043af6ad8de01c01c27a4b873350d2677f8e780f3b1636f8

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 add56ec49f8f478e84a934606effef1c
SHA1 1262ae87ef755e40752740df90d21352d5fc81ec
SHA256 22e509cf2b7202fc6b04c3d9a1b137477f11471d58a48c1f9514f89450217327
SHA512 c095f193d221696f3b087c3f224a559ad0efe4852a5392c8a3ab03f80183beec2a8327892aa481c85f1bf8165b76a029555f250e0dd5f396c823feacff4c06f1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 f265c7bf1990b54f4e6f1e1cb29cbc66
SHA1 8851ec5cec8fc3e4783d5a7fa70f25a5788903dc
SHA256 f04b61198d5aec0e8c40fd4dd2742e3f5170a5e05d85ceaca175580dcdc549d8
SHA512 107689c377cc59a7c9f254f4d67ba54bf84b9ee9154bb94d908bdcab19e68b36e7a2862f433177c24f34ff006aa170fec050e10e6bc8606b6264759338e7ccac

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 58fc93ab81ed750f0061ef75cf02dfa0
SHA1 1db16ad55bf877d8d3b786b132082c76cd1601ee
SHA256 d1452aefa7ecefc42ffd13ca37f43bd1aa4aa29399318874c3725cb655096e8c
SHA512 e5a56f9a756da60d96146eabe46934731b32e8d84f4119fb04afc9ee9e3615ccbb6cd48ae64a517dc0f2a05a4d088b5b3c3656284dd32134ee24849f3500a0ca

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 25b00c24f214785aaffe13beeacd27d6
SHA1 e3270297741e275f6220ee27f246ec80d8b293e4
SHA256 3b2f4abc9484ce994b823bf4e2d667b0d68af7b16de97fc07303fb2ed27ad5d3
SHA512 063fb21abf27d3091f26fb32f1c2221e339e5d3d048069ad368dd910acc36de00de73a43ebffbe85ae85a31f40d4fae27beeaa24aabbb2b46395ad00217598b9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c91b536dfeac1bee1cf1420e89a43531
SHA1 3fcee38c0ec460f915aef41bf674e589d49d85c7
SHA256 f922f08ce7a5bf8ec249dab699f237d951a097223236c2a03be89875054b913d
SHA512 231dd62e13e86dd88dc0106e96ad6a9d5f2cf181bf1cee521cab90000cbe2a09efaff9c1a0b307c4b78674286669eb906dcc87ac011294b01f2124ca3ad52307

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 38f5b22b33c28e918b719bbfadeb1ab8
SHA1 37282b4fe212052453c4cf77bf39810e9446c65a
SHA256 c07dab30d5dee45c2fd696b9424c0af79492dde10a9e6292d1997f30b1f6b990
SHA512 a7092dbbaad20bc3452c69e0c05e27005038bc8b22964fca4fd7e13122d3221fb555f3a8e9738256b89956514dc138078bf4001a10a5328917d53d47d495fe74

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 5cd7569f326b9f410049198326c04d39
SHA1 a0a9ecad08a8729bb49787b919d2a83df9547b50
SHA256 4c34ea57658b26ba11b3ef549a8f18a88e4d2383d54a17a2d7ce8d857a4717da
SHA512 c99d4143908693a91d4bd29c7c97d6717d6a5462b552dfb0c7014de00d1fa532ec6fb83586bd5c91ed822c0f3847454b5b96a4691f36dd82a6ba9ce27a91ee39

C:\ProgramData\FileCenter\MRUIMGEditor.ini

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\ProgramData\FileCenter\ColumnStatesCab.ini

MD5 4379bb238d6b82150a42305a3226f312
SHA1 4ce1ae33bcd33af5ca555a9620cf1e377236efcf
SHA256 9727636fff6e6802a99e4bf42715bb9524611907e21515255d7398f3e189b105
SHA512 add2b339fa10940026bc9061b9570a4772eaf6e7b70e9b1814f9179602a0599cea2f98421bbde0cd87150fc5c097d7fb86d42ba0be50bd7d8ea22209a0cd2f3b

C:\ProgramData\FileCenter\ColumnStatesCab.ini

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\ProgramData\FileCenter\ColumnStatesCab.ini

MD5 381917910c3097b13662f77575e4419b
SHA1 8e50e5b0c7bf549c7129d20d196cf38718ac33a6
SHA256 69574d957e2b85c1a74f3e56d2dbedae12a3f7c9e1dfafdfafa483fc42cfbda5
SHA512 a21c3b6512767f6cb2e707b9a6e7366010e343c617a0f1e281b59343b8236bba4339b268d1080ec0e69713444f81aca24e7d3715867dd4cf9139a6a0dd540cc7

C:\ProgramData\FileCenter\ColumnStatesCab.ini

MD5 3634333c0e07b66358752d92c67c8670
SHA1 ccf76414b160330097f13e70c9ffd855480996ad
SHA256 c136ecd2939792c7d6831c9ed5326010f9691d2d7e9e9adf921ed022b3ccf1ab
SHA512 10eba20ba958d2479e91c56d75e0c9735e9b6781470383cf55a56b45d8d54249512b33cb505fdb3486823e652ca299003578e42b56b79e6ce89f190e955a5dc2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 f005bd7ddedf9fc5a9aab82a753106cb
SHA1 af979c6bb3c69e0a9655a89d50845eb58c426928
SHA256 0e44a4ed4c83b2f45debee7e8068947ec981223df8cf23c93028c0d2cec785cd
SHA512 b5c8bf7b476013a645ad824602b6f52c397eafde5989ba51d38a1d89d5c3cdbda16ad631854bbfcb162ab7ca17b2bd0140c56cf421cb5817076beb5686fe421f

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 13:23

Reported

2024-06-14 13:56

Platform

win11-20240508-en

Max time kernel

601s

Max time network

548s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

Signatures

Vidar

stealer vidar

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{3780ab31-c524-4f3b-a4db-79d692700a62} = "\"C:\\ProgramData\\Package Cache\\{3780ab31-c524-4f3b-a4db-79d692700a62}\\PDFXLite10.exe\" /burn.runonce" C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\FileCenterAgent = "C:\\Program Files (x86)\\FileCenter\\Main\\FileCenterAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\FileCenterAutomateAgent = "C:\\Program Files (x86)\\FileCenter\\Main\\FileCenterAutomateAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Windows\System32\MsiExec.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\DRIVERS\x64\pxcdrvL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File created C:\Windows\system32\pxc50pm.dll C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\pxcpmL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File opened for modification C:\Windows\system32\pxcpmL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\pxcdrv.xml C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File opened for modification C:\Windows\system32\spool\DRIVERS\x64\pxcdrvL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File opened for modification C:\Windows\system32\pxc50pm.dll C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\PXC50f.DLL C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\PXC50UIf.DLL C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrsbarcodeevoi.dll C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-PURSL.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Help\is-A33T0.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-R7QEV.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-9UALP.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.64.tlb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
File created C:\Program Files (x86)\FileCenter\Uninstall\FileCenter\is-6H063.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-8V6G9.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.tlb C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\GdOCR\is-7A5CF.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Help\is-E2OQU.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrsjbig215.dll C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-QDCU7.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-KVONS.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-QVA6L.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.uk-UA.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.Imaging.ML.dll C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrs15_wrapper.dll C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\GdOCR\is-0T8A0.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-OID76.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrszlib15.dll C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-BL7ER.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.sl-SI.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterScheduler.exe C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-TQ0AU.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.fy-NL.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-BID7U.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.ar-SA.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-P32O3.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-T1Q1M.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-SHK47.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterConnect.exe C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-G02R6.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.zh-TW.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-JOBBM.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-8GIKL.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-5P7V1.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.ar-SA.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\secman.dll C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\EZT4Ocr.dll C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-5B8VL.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-0V71C.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.pt-PT.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterOCREngineRI.exe C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\VSTwain.dll C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.pt-BR.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.ja-JP.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-J7G7G.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-8PTFJ.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrs_sentinel_software_protection15.dll C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-9ABNK.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-QAT31.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterProcess.exe C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenter.exe C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-EIP64.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.hr-HR.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.dll C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-SID15.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.de-DE.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.he-IL.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.zh-TW.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\ocrdll.dll C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-59G9H.tmp C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI75E.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFED97EAD6200B65E6.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFAE2.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF8B3F6B5BC35F3AB7.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI6E0.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFB03.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF59140BEC34330829.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{6318D993-1BE8-4BE4-B9E9-D6BFED11A071} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e59ca40.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF1640429000A4B319.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e59ca3c.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFAA2.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFAF2.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFCBB.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{6318D993-1BE8-4BE4-B9E9-D6BFED11A071}\AppIco C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{6318D993-1BE8-4BE4-B9E9-D6BFED11A071}\AppIco C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFB04.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFB15.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFD78.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI430.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e59ca3c.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe N/A
N/A N/A C:\Windows\Temp\{D56144A5-47BE-4B92-9195-65A1653AD379}\.cr\vc_redist.x86.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe N/A
N/A N/A C:\Windows\Temp\{E03CA974-A703-4C0C-B310-59E5C4E5A8B9}\.cr\PDFXLite10.exe N/A
N/A N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Temp\{D56144A5-47BE-4B92-9195-65A1653AD379}\.cr\vc_redist.x86.exe N/A
N/A N/A C:\Windows\Temp\{E03CA974-A703-4C0C-B310-59E5C4E5A8B9}\.cr\PDFXLite10.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Windows\splwow64.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\splwow64.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AFC06F6-7848-37B5-8044-97A2EBECF8BB}\InprocServer32\Class = "GdPicture14.BookmarksTree" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CBD34A5D-CCD7-47B5-B8D4-121D40FA0934}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CC0D923-B9ED-310C-B453-D1A59F25712C}\InprocServer32\ = "mscoree.dll" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{51DE5D08-F43E-386D-AE8D-9A8EEF3C7B60}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6BA216B3-0CCA-39E5-B68B-F4F943B65D9D}\InprocServer32\ = "mscoree.dll" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CBD34A5D-CCD7-47B5-B8D4-121D40FA0934}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32\ = "mscoree.dll" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{718C8EE7-1EEF-4717-8E60-C3661B610550}\InprocServer32\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\WOW6432Node\CLSID\{021BDF87-EEFB-4384-9183-F8170E3DC459}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CBD34A5D-CCD7-47B5-B8D4-121D40FA0934}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{718C8EE7-1EEF-4717-8E60-C3661B610550}\InprocServer32\Class = "GdPicture14.GdPicturePDF+SmartRedactionOptions" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\WOW6432Node\CLSID\{021BDF87-EEFB-4384-9183-F8170E3DC459}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CEB68BB-FEF5-3F6C-9F82-7C6B1F524A3F}\InprocServer32\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6835517-900C-37F4-B861-936E79F91A48}\InprocServer32\Class = "GdPicture14.AnnotationManager" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A46B9230-3A18-3180-9BA9-1D063B9DB1B7}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F656181-7551-47DC-8A8A-7BB562F91A6F}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6835517-900C-37F4-B861-936E79F91A48}\InprocServer32\ = "mscoree.dll" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9E52549-FC4C-33F9-99DE-61302E5F2E47}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4813FAB2-FDF6-3ACA-8C00-511671D1214B}\InprocServer32\14.2.69.0\Class = "GdPicture14.GdPictureOCR" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBED514A-A877-398F-AE2A-A1EDE5F43724}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24DFB749-780D-41B4-9BE3-8894D202B944}\LocalServer32\ = "\"C:\\Program Files (x86)\\FileCenter\\Drivers\\PDF-XChange 5\\pdfSaver5.exe\"" C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CBD34A5D-CCD7-47B5-B8D4-121D40FA0934}\InprocServer32\Class = "GdPicture14.GdPictureOCR+SpreadsheetOptions" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32\Class = "GdPicture14.GdPicturePDF" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{732C85A4-B68F-4D3F-920A-B13DB0BDC9C8}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D8DD4B1-B719-303C-8F01-7C00B4A93B1F}\InprocServer32\Class = "GdPicture14.GdPictureSegmenter" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CC0D923-B9ED-310C-B453-D1A59F25712C}\InprocServer32\Class = "GdPicture14.GdViewer" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6835517-900C-37F4-B861-936E79F91A48}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9E52549-FC4C-33F9-99DE-61302E5F2E47}\InprocServer32\Class = "GdPicture14.GdPictureImaging" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4813FAB2-FDF6-3ACA-8C00-511671D1214B}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{732C85A4-B68F-4D3F-920A-B13DB0BDC9C8}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F656181-7551-47DC-8A8A-7BB562F91A6F}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A46B9230-3A18-3180-9BA9-1D063B9DB1B7}\InprocServer32\ = "mscoree.dll" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A46B9230-3A18-3180-9BA9-1D063B9DB1B7}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D8DD4B1-B719-303C-8F01-7C00B4A93B1F}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CC0D923-B9ED-310C-B453-D1A59F25712C}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{718C8EE7-1EEF-4717-8E60-C3661B610550}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CC0D923-B9ED-310C-B453-D1A59F25712C}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBED514A-A877-398F-AE2A-A1EDE5F43724}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AFC06F6-7848-37B5-8044-97A2EBECF8BB}\InprocServer32\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6BA216B3-0CCA-39E5-B68B-F4F943B65D9D}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{516A4C96-825D-3A42-8C62-0ECE20DE935D}\InprocServer32\Class = "GdPicture14.Imaging.GdPictureRectangleF" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CEB68BB-FEF5-3F6C-9F82-7C6B1F524A3F}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6835517-900C-37F4-B861-936E79F91A48}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6BA216B3-0CCA-39E5-B68B-F4F943B65D9D}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6BA216B3-0CCA-39E5-B68B-F4F943B65D9D}\InprocServer32\14.2.69.0\Class = "GdPicture14.GdPictureDocumentConverter" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9E52549-FC4C-33F9-99DE-61302E5F2E47}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4813FAB2-FDF6-3ACA-8C00-511671D1214B}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{718C8EE7-1EEF-4717-8E60-C3661B610550}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBED514A-A877-398F-AE2A-A1EDE5F43724}\InprocServer32\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DF179B8-96F1-4F3E-9338-DFEEB61B810A}\LocalServer32\ = "\"C:\\Program Files\\Tracker Software\\Update\\TrackerUpdate.exe\"" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CBD34A5D-CCD7-47B5-B8D4-121D40FA0934}\InprocServer32\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AFC06F6-7848-37B5-8044-97A2EBECF8BB}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4813FAB2-FDF6-3ACA-8C00-511671D1214B}\InprocServer32\14.2.69.0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CBD34A5D-CCD7-47B5-B8D4-121D40FA0934}\InprocServer32\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AFC06F6-7848-37B5-8044-97A2EBECF8BB}\InprocServer32\14.2.69.0\Class = "GdPicture14.BookmarksTree" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Program Files (x86)\FileCenter\Main\FileCenter.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Program Files (x86)\FileCenter\Main\FileCenter.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ef00fed98b74ef930000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ef00fed90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900ef00fed9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1def00fed9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ef00fed900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\AppPath = "C:\\Program Files\\Tracker Software\\PDF-XChange Lite\\" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\Policy = "3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40} C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\AppName = "pdfSaver5.exe" C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\AppPath = "C:\\Program Files (x86)\\FileCenter\\Drivers\\PDF-XChange 5\\" C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\AppName = "C:\\Program Files\\Tracker Software\\PDF-XChange Lite\\pdfSaverL.exe" C:\Windows\system32\msiexec.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{379D1DBC-5BD9-3597-9C9E-8C10E8337A1A}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04F02086-5AEB-39DB-AFBE-B01E669F37FB}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{732F9719-9EA7-3026-A19D-D320EDAC3088}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{718C8EE7-1EEF-4717-8E60-C3661B610550}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6835517-900C-37F4-B861-936E79F91A48}\InprocServer32\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{FCF4E0C7-3638-3F61-B268-29C7289B56FE}\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF68A980-B679-48CF-ADF3-951AD4BD343B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C6D17E84-23E1-461E-BF56-5E5DD195B53F}\ = "IPXV_SearchView" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21934FDF-3C12-386C-AF83-930445E4BF5B}\ = "_AnnotationStickyNote" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{84BB3940-BA93-3C54-8097-50C16DB71F93}\14.2.69.0\Class = "GdPicture14.TextExtractionOptions" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8D00937C-06B9-4B5C-9A94-A7E046336B01}\ = "IEventHandler" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{984D8349-2159-4CF7-BEB1-713EAB511205}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{7F7BB18A-C89F-3DE6-AFBB-0F17F10614A6}\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6B127819-3AA0-3135-9117-359C1749FAE9}\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dten600.SearchResults C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F007E7B-4910-40F1-9CD8-D012AC81B89D}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{577BFFBE-03C2-3DB4-8572-A2BBFA057669}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DEF6A2E-AE0C-33DB-907D-F5C2153DE192}\ = "_AnnotationStartEditingTextEventHandler" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBED514A-A877-398F-AE2A-A1EDE5F43724}\InprocServer32\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4F0EAD1-C256-40AD-9CCF-B9CD8872EC9A} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{2357CADF-E718-330A-8E7B-0EB5BDC3CD09}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{146A78C6-C6F0-3A13-A4E2-0F2DDF535EAC}\ = "_AnnotationConnectedLines" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{732C85A4-B68F-4D3F-920A-B13DB0BDC9C8} C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73D6873C-BD16-49E6-A160-81D847A24DF7}\ProxyStubClsid32 C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D98CFAA7-4EA7-4046-AA77-6A553D4A52C4}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A46B9230-3A18-3180-9BA9-1D063B9DB1B7}\InprocServer32\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9764FFB4-99C8-4FE5-BF07-225580214F60}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B5D2ADEF-2518-34D1-967C-B9AC8700BCB7}\14.2.69.0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBF041E8-7CFC-4389-9122-809AAA85BE8B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F6E91C4-12B5-4E2F-9C2B-479EF525A9F7}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9DCA6E8-8C23-4765-8305-C58DEF3E27E0}\ = "IPXV_PlacesCtlCallback" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{06D17FFF-A590-329D-8491-4258A6491082}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{26571069-90C7-3A06-94F9-5A1E994F1471}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{798CBE35-B27D-11D3-B57C-00105AA461D0} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F16D4312-0B2D-4C64-9FC7-DBC648B9B3AA}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1B4807E-65DB-4FE7-88FE-DB703CF57807} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A967E5D1-B0E1-11D3-B57C-00105AA461D0}\ = "IServer" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F25D53D5-5F88-4FDD-BB3F-88EFC7E7C2CE}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60097BCC-B13A-446F-BA2D-6413419E15A9}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55767E02-2E2D-47FB-A666-BB6B3498521D}\ = "IPXV_SignaturesView" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A9134A9-20F7-4D8D-806D-8DEFDF70029F}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A9E3FEF0-9328-319F-80AC-0D7BF0A34234}\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{FCF4E0C7-3638-3F61-B268-29C7289B56FE}\14.2.69.0\Class = "GdPicture14.PrintSizeOption" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7AE52AAD-8807-46DA-8EF6-C20E2E8AEF2D}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{419BF6AA-AA35-3FBC-B01B-554F71547437}\14.2.69.0\Class = "GdPicture14.TwainPixelFlavor" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{874C499C-FA85-4B0C-A5E9-CA8F022CAC9F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EB0BFF89-7F16-360E-A5B8-7D5E5BCF7CB3}\14.2.69.0\Class = "GdPicture14.GdPictureRotateFlipType" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8B11A628-6903-37DD-87B4-2EFAA63F6E01}\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0A8E6A2C-43A6-48FE-953C-4668DC9F0352}\1.0\0\win64 C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D00937C-06B9-4B5C-9A94-A7E046336B01}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{74CC2924-090C-44DF-BDC8-1A0EBB1C95AC}\ = "ILocalProtocol" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79A9AD9C-3D6B-496B-B8E4-C09E54E21156}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7ED881CB-9DA1-4D56-94E6-5DDE88D5E844}\ = "IPXV_PDFNamedDestsSelection" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4F44B54-E71F-41F9-95E7-401437931922}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{18861F84-0A32-35DF-89FD-D3822FE9165F}\14.2.69.0\Class = "GdPicture14.BarcodePDF417ErrorCorrectionLevel" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E09B1C3C-4818-319E-8C07-BCEAB34C5DF6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BC27C16-F681-4800-9135-6572B6DCDA7A}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78527649-463C-49AA-8EA8-8DC10505FB31}\ = "IPXV_FormFieldsEvent" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBED514A-A877-398F-AE2A-A1EDE5F43724}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32\14.2.69.0\Class = "GdPicture14.GdPicturePDF" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF3EA9CF-3882-4A6A-A9A4-BC56D8B5B083} C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4184 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp
PID 4184 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp
PID 4184 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp
PID 5032 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 5032 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 5032 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 5032 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 5032 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 5032 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 5032 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 5032 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 5032 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 4800 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 4800 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 5032 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 5032 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 5032 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe
PID 1520 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1520 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 5032 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe
PID 5032 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe
PID 5032 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe
PID 4660 wrote to memory of 872 N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4660 wrote to memory of 872 N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4660 wrote to memory of 872 N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4660 wrote to memory of 1184 N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe

"C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp

"C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp" /SL5="$40220,314098152,831488,C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe" -S -INFO "-1" "3" "11" "C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtilsInfo.ini"

C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe" -S -INFO "-1" "3" "11" "C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtilsInfo.ini"

C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe" -CLOSEALL

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterPortal.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReceipts.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReports.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileAgent.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe" -INSTBEG

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterPortal.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReceipts.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReports.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileAgent.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -INSTEND

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\PDFXEditCore.x86.dll"

C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe

"C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe" /silent

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\dten600.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\lbvProt.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\VSTwain.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\secman.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.dll"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" /s "C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll" /codebase /tlb

C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe

"C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe" /install /quiet /norestart

C:\Windows\Temp\{D56144A5-47BE-4B92-9195-65A1653AD379}\.cr\vc_redist.x86.exe

"C:\Windows\Temp\{D56144A5-47BE-4B92-9195-65A1653AD379}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572 /install /quiet /norestart

C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe" /install /silent

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -PRINTER

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" /s "C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll" /codebase /tlb:GdPicture.NET.14.64.tlb

C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe" /quiet /norestart /log "C:\ProgramData\FileCenter\PDFPrinterLog.txt" PNAME="FileCenter PDF Printer" ORGANIZATION="FileCenter"

C:\Windows\Temp\{E03CA974-A703-4C0C-B310-59E5C4E5A8B9}\.cr\PDFXLite10.exe

"C:\Windows\Temp\{E03CA974-A703-4C0C-B310-59E5C4E5A8B9}\.cr\PDFXLite10.exe" -burn.clean.room="C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe" -burn.filehandle.attached=564 -burn.filehandle.self=684 /quiet /norestart /log "C:\ProgramData\FileCenter\PDFPrinterLog.txt" PNAME="FileCenter PDF Printer" ORGANIZATION="FileCenter"

C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe

"C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.be\PDFXLite10.exe" -q -burn.elevated BurnPipe.{98ED42FD-3B55-4E4B-8AF4-DAAE13B1A010} {9E65DEC6-95D7-4730-8EF5-BED0E8F8A3D6} 2788

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 6759C8AFDFDBF48CC0F7378BBB80B1C9

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 0039BDBF6E43F5D47EBC61F52D1EF6AF E Global\MSI0000

C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\\PrnInstaller.exe" /L /I_D_R_M_P /F /N "FileCenter PDF Printer"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "FileCenter PDF Printer"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "PDF-XChange Lite"

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -DRIVER

C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe" /VERYSILENT /NORESTART /NOICONS /COMPONENTS="pdfSaver,PDFXChangedriver" /DIR="C:\Program Files (x86)\FileCenter\Drivers\" /PName="XChange Internal Driver" "/Organization:FileCenter" /LOG="C:\ProgramData\FileCenter\PDFDriverLog.txt"

C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp

"C:\Users\Admin\AppData\Local\Temp\is-K3I4Q.tmp\PDFX5SA_sm.tmp" /SL5="$901E2,5384545,119296,C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe" /VERYSILENT /NORESTART /NOICONS /COMPONENTS="pdfSaver,PDFXChangedriver" /DIR="C:\Program Files (x86)\FileCenter\Drivers\" /PName="XChange Internal Driver" "/Organization:FileCenter" /LOG="C:\ProgramData\FileCenter\PDFDriverLog.txt"

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe" /W0 /I /N:"XChange Internal Driver" /Base:"PDF-XChange "

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe" /RegServer

C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe

"C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe" /install

C:\Program Files (x86)\FileCenter\Main\FileCenter.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenter.exe"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "FileCenter PDF Printer"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "PDF-XChange Lite"

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -OLOFF

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.filecenter.com/action.php?Action=Welcome&Refresh=1&ProductKey=&KeyID=-1&PTID=1&SourceID=-1&CustomID=-1&VerID=-1&PartnerID=0&WelcomeID=0&Version=12.0.16.0&CN=NGOMEWNG&UN=Admin&Trial=0&DaysLeft=0&s=&cnt1=&cnt2=&cnt3=&cnt4=&cnt5=&cnt6=&cnt7=&cnt8=&cnt9=&x=1235

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcb41e3cb8,0x7ffcb41e3cc8,0x7ffcb41e3cd8

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,14364348121740250360,4253366768923198358,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,14364348121740250360,4253366768923198358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,14364348121740250360,4253366768923198358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14364348121740250360,4253366768923198358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14364348121740250360,4253366768923198358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,14364348121740250360,4253366768923198358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8

C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe"

C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe" 3108

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx" /o ""

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.filecenter.com/action.php?Action=Home&Refresh=1&ProductKey=MB76RDL-MTJCMTS-AAPZH&KeyID=0&PTID=3&SourceID=0&CustomID=0&VerID=12&PartnerID=0&WelcomeID=0&Version=12.0.16.0&CN=NGOMEWNG&UN=Admin&Trial=1&DaysLeft=15&s=&cnt1=&cnt2=&cnt3=&cnt4=&cnt5=&cnt6=&cnt7=&cnt8=&cnt9=&x=1235

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcb41e3cb8,0x7ffcb41e3cc8,0x7ffcb41e3cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,14062734570371680941,16191837229114136292,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,14062734570371680941,16191837229114136292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,14062734570371680941,16191837229114136292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,14062734570371680941,16191837229114136292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,14062734570371680941,16191837229114136292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,14062734570371680941,16191837229114136292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 /prefetch:8

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx" /o ""

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe"

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3108 -ip 3108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 2260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3108 -ip 3108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 2260

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.filecenter.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.filecenter.com udp

Files

memory/4184-0-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/4184-2-0x0000000000401000-0x00000000004B7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-KM0KE.tmp\FileCenterSetup12.0.16.0.tmp

MD5 0acf3c16e6faca9c0aec525f53d03866
SHA1 5c3960b48d2b72ad02e59470d8a7b690ee826f9e
SHA256 2c470730bf3efa3f4a9dc184548abefbab8c4aecc43e14834c5810159019c151
SHA512 17d98a3b52eb89e02a371f1d6effa59f624696cd14b0589fe436640ddbe04fc6c5d82834f73699dbaa32a7a69343f82863820e72e225e17d710c4de5102b46c2

memory/5032-7-0x0000000000400000-0x000000000071A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-60LCE.tmp\FileCenterUtils.exe

MD5 e9638374a27160513f1a62827b6cf102
SHA1 b9da58896020d46c4ef16f8f1b332d5f6c1e6f0f
SHA256 c064ba394872e6a8277a5c71b50da34b800d682e403c6b80ec3ba37badf38942
SHA512 9632c8416f542dc96f22a0ddcd109e85c29368b1263d86f74bab39aae8e9271a7b3e2eea18932cf4e3fb5e269d3892016b878d29fb6dad002db11367849f293c

memory/732-12-0x0000000003350000-0x0000000003351000-memory.dmp

memory/732-13-0x0000000000E80000-0x0000000001916000-memory.dmp

memory/4184-14-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/5032-15-0x0000000000400000-0x000000000071A000-memory.dmp

memory/5032-33-0x0000000000400000-0x000000000071A000-memory.dmp

memory/4112-35-0x0000000000E80000-0x0000000001916000-memory.dmp

memory/5032-37-0x0000000000400000-0x000000000071A000-memory.dmp

memory/4800-39-0x0000000000E80000-0x0000000001916000-memory.dmp

memory/1520-41-0x0000000000E80000-0x0000000001916000-memory.dmp

memory/5032-66-0x0000000000400000-0x000000000071A000-memory.dmp

memory/5032-272-0x0000000000400000-0x000000000071A000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\FileCenter.exe

MD5 879d5b401a73cc57a3166ba01ce70c60
SHA1 ee8b47af48514a3b65f4ee838c95e7a3a64d3434
SHA256 82da544c9d730c17c34a253c29fd7d621e8cdc064e0220c27e43bb0dd60c4ebe
SHA512 6e49343acca8ab878b4cf9e12ce4d796decd7f44c7068f8d90f5ad2eebbab31c15c82bbf66bcb571120a9bf8e375055558308d00b66053591c6ec94fb514b3b6

C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe

MD5 b9718823c993fccb6352cc0210993569
SHA1 4d551f7cafd0040ff9657ca644c1365f3e7847ae
SHA256 a173ba320929c93b9bf41186a0692d753da812b8691dcc416c16abdf004dbf89
SHA512 6e513ef7535539cff90e88b95c5f57bb9e262cebbf1e51bc8268595347fbf06f628cf16eaa974d7eccd2a285ff2f8f56867c4292c1fe4fb7b0ee90f5acee9747

C:\Program Files (x86)\FileCenter\Main\dten600.dll

MD5 22cf875a0cf0ad89f5f7d7ac6628a598
SHA1 c2a9620579a08d6a91557e6cb8f1d2585392d30d
SHA256 11ef1b8791cfd8fee0923ec685ae1d29485349ce7d2d37a15ae1615e8d646baf
SHA512 3b59898730a9eb4a8f4347b8c854983636b28f6641b072fdd0d7f9190b905fc9b03dcf204154072048dc1a6a24785d2aead865b5bf160c9af9df87cf4175c608

memory/1184-572-0x0000000000560000-0x0000000000568000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\lbvProt.dll

MD5 120387e48d0556538ef3ee68de18a707
SHA1 0633de57f7ef851115be39d407db8e08986b3d93
SHA256 e202172ad8799ee0feee2559ac06f2cf75530f702f7e11d0cb4c1b3ec57eae4e
SHA512 a7509c2822bd7f08b5e67dfbd3d9ac701639599b5681966f5276f51e60608dcd7dafaa953f7589d99de7ba7b68eaa56be0ecb2c074f5c4ba6ba114880507b1da

C:\Program Files (x86)\FileCenter\Main\VSTwain.dll

MD5 13f5f7e228ce2b8a3a41dbad4e451279
SHA1 1b3837572602b2620b75bf2ad2aeab89a64f5287
SHA256 11b50ff0bc4e72cd2dd47fb8070a86781682b92a9fb1010a5fae97276afb2292
SHA512 24ea8072abb5c0d4083989539f399ad076cc92260aaf0317320dddb4196e752e1c082d386c75049a343b1c62765d587f2b66374b53e7b24326ee6129a7aa856d

memory/2296-578-0x0000000010000000-0x00000000101C8000-memory.dmp

memory/5032-577-0x0000000000400000-0x000000000071A000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.dll

MD5 2b9bbd88d6b6a3b7c417cbb0eae69bf4
SHA1 c43ab9fa5c1085ba21280d143f8b8322d6a93883
SHA256 1e5f8dbd4c08faf3a0a84b6af17454d9d21459618b411696b9604af80ee9fc0f
SHA512 f07ae3e76066960a3b657146b83da724ca13873edd82d7314d048593c3e6021ced3297459d46a30daf95189631bfd4c941e44d91433549dcc70efb5407543a30

C:\Program Files (x86)\FileCenter\Main\secman.dll

MD5 085d87f49daf13496e0e018c4008fae6
SHA1 4b0c3058b8ace7e8242c941b449daa968f5b45c7
SHA256 d1f1e3717a68166942d1f7a71b78e35e3381edbb07d7d37ae8b603dcc3ffad15
SHA512 52886de13e538e0eef364a16da1ccd24a571450d417ead4ddb689efe8e8099f9964c5f6076a239e833bd41c88f2f95f30c20d722f880837aa541be366407145b

C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.ini

MD5 70da425f8aac14b1484047edb83e60e8
SHA1 69d09199af5a5ba4ed4e1d59432fec784d5271e4
SHA256 258d4ad31457b1c117b248b6ba0dd1c44ba6ad0a0839623ced45ce15ebbd0a7f
SHA512 a9cf352b79a8f38f03a781bf55a94e2c1344e1de55e9ea21e736ad436d7452f8349a64fec3b46e7ddc1d11f5fa3ecc80329b5b4e1da702680e9c2223e57943d2

memory/1044-585-0x0000000000180000-0x0000000000192000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll

MD5 d9806fd0eeafd9f89e0473ad52889283
SHA1 d6fca558897aaa6703129557e2d02b1a84765dcb
SHA256 aa2aafe588aecd1a10bf05dcd675143061a55bcd5bc83bd749bde7b85d21dbc6
SHA512 796c609dc6fa4c6fe1e6909ae3a4a22cc06c900f34b999d77a9805767f69f1b1d96a99e9ee03ad6ab68e7f6bb5fa3269c1d73db4af68a2834bfd5cbf2fe91422

memory/1044-589-0x0000000007390000-0x000000000987A000-memory.dmp

memory/1044-592-0x0000000005620000-0x0000000005BC6000-memory.dmp

memory/1044-593-0x0000000005170000-0x0000000005202000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe

MD5 35b40b21383ac38487ceec8ab6e53565
SHA1 59894bd9c96361b475c3b4b7ca9719c72e813d04
SHA256 caa38fd474164a38ab47ac1755c8ccca5ccfacfa9a874f62609e6439924e87ec
SHA512 3a00b40ba8cd1cf8a523efab656f5b8910a3b07f9d8fba4ffc07745165b6375affd77b00fd3064fa72fb984c1773438a39e67a55363be23dd8fe1727c1016b8e

C:\Users\Admin\AppData\Roaming\FileCenter\Config.ini

MD5 b2ad8f8dcc45644ea167317d050faac4
SHA1 215091d6ad9d4f210b85e675b17c60a7300ca9b1
SHA256 9aaebe4ab06e9de08e28b9b4da9248442c502ef5411d7d734c13af1afa2c2dd0
SHA512 528737e85d799e0312c335bbbb856f12ee885465e9b999d6cfb1b64d8c003744a5a6d6cd7ae2b6e41b9cbe23115990acd65debfcdd15e1677c955944403da6f4

C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe

MD5 42d9ffbb0b7ef3cbdeb0c005619b12fb
SHA1 fbaed95c25aa26c43121e8421b5154e9e5dcdca0
SHA256 59e5b75c18c82acf2d94a1fd9b0a67af6795d594e1f837df1a80eec66671d307
SHA512 c77b91ca41b13bb471ced5346f998805430a33e210c09c0d7e0b0a7573d9e95da1bc5e351df08c871e1c3e962b3ec4b9fdb5ef5cc806fd87ef42f50ddd99d7cb

C:\Windows\Temp\{D56144A5-47BE-4B92-9195-65A1653AD379}\.cr\vc_redist.x86.exe

MD5 86123c033231dd7e427d619ddeefd26a
SHA1 608c085348fd9c4e124e6f28f0388ccdac6ab2b5
SHA256 d863fb2f65bb6eea492e79ab9d09a53cc226e85f57d6545cb82f60b122a4b737
SHA512 ffb574123b350d3c9434abc88baa050ae6e54b5b9ebf3f1dcf4bf079284135696004508653e74a3a3c2fa8e4c1b681c3f31d5fe69e0f0c5f45ed37f9ddc61e78

C:\Windows\Temp\{1FCAF106-F599-4046-ABBF-9703EAE3FCC3}\.ba\logo.png

MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

memory/1044-648-0x00000000054D0000-0x00000000054D8000-memory.dmp

C:\Windows\Temp\{1FCAF106-F599-4046-ABBF-9703EAE3FCC3}\.ba\wixstdba.dll

MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

memory/4252-685-0x0000000000E80000-0x000000000163B000-memory.dmp

memory/4660-686-0x0000000000C00000-0x0000000001696000-memory.dmp

memory/1044-688-0x0000000006070000-0x0000000006092000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.tlb

MD5 5290be1a2d33fae83651b477b38ff917
SHA1 43e5a95e481a185014ce390a924cb72bdb65e295
SHA256 7366f97ef99fe000d554cc209b65fadfcd40a6b0d519c19b9dc537256c934bef
SHA512 fc2dd83bbb8ae04318cba708678f2f7527ff6680904df50044a2d6eb187f9a1d50f5f06456b0bc9a925d5eb51bd2a65b790ddd33c88a958159f1fa0ab32f86a2

memory/900-692-0x000001B267CE0000-0x000001B267CF0000-memory.dmp

C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe

MD5 4c61ee01d5b84db67c38c10d3f210f39
SHA1 844eab66505dc4eb88dec70c3f20307365c350ac
SHA256 a7e10bda5cb2e1c347b2ee682385fd56ff5da05c659c665abc0b526f639a5583
SHA512 a44a2bd871c9f0f654b0e627accc9d4388390e5e5b7326a3372a103886d74b89ab78e235e1b986da9acf0f08fdf45b642ec26000bbe32de92a44b1978f4c2f80

memory/900-694-0x000001B26C8D0000-0x000001B26EDBA000-memory.dmp

C:\Windows\Temp\{E03CA974-A703-4C0C-B310-59E5C4E5A8B9}\.cr\PDFXLite10.exe

MD5 63ed90cdd501829a2319f8cf86c52bd2
SHA1 da198bec49015e98baa5b2cb91903f659e31dd37
SHA256 529bcd90e571d51a19396cb457bf7eebecf494613030389fa7c5b25b8e42757f
SHA512 d8cc05a5d481e17432125d21d58c2b32696c8b3e6632f911184292a0f0b24910e9dc5cc3ae2bdc6d87e478aef81504aa34520d3bd6813517e4b9347eee0eaa19

C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.ba\logo.png

MD5 04967ef5107480ea36b3e2e97af7eb7a
SHA1 6efdd4484dcfcfd45b3c887c852f0abb1a02a645
SHA256 63f2616963b68ac13dab898c1b5938ab1b353a9ba0f73c6a2f2c3c5c9eac0b21
SHA512 00ae4cff10b1a6e504d590d49bc4af707ad33c1739ed46f648dc348645bd5d4b61bf0c84448c78d7542fb6d7294f3aa753b4106579f15b1d726bf1118594c581

C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\.ba\wixstdba.dll

MD5 0ba387d66175c20452de372f8dbb79fe
SHA1 5411d41a7d88291b97fb9573eb6448c72e773b70
SHA256 7b3d4a22a56cd80f19c48a321f978f728d34b8227cdc7fcadeb76b7506b2bb33
SHA512 13ec6e6ddc602e8053aadd4dd84ed87c23b581f2a41d738e32a522128ca4985dcfcaedc7fab192085f0eb4facd1cd7ad91ccaf8505491e29288d2f66cbf705fd

memory/900-727-0x000001B268200000-0x000001B268208000-memory.dmp

memory/900-728-0x000001B269B50000-0x000001B269B72000-memory.dmp

C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\PkgLite64

MD5 e91e50fc80f7d84561db5823595e5b63
SHA1 b3e40b17a668586e86f346e9a7e3b8ef4838d437
SHA256 3203656dcafaf1ae128dae78bab26829bf0c2c9e1c255a8ca15ed176651d8948
SHA512 c9bb45c0882af7a2f5b6294fa2c29202ac529a6f1584e763a00c4812782f8274498a9c008ef0901dd67d895fd448e0eeb19a75cfe98bcd4c050c8856f97e5034

C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\cab66549ACD4EE6139A64068CA8626575A9

MD5 bf193f70c4ba12e12a592df1cdb17b40
SHA1 e84a6d1cbcdc79926f7defef1ad4b7a8a651b5cb
SHA256 cee91939598abb3ec23ce0dc93c7690421efdca54795997558ef0fc617442a82
SHA512 23077213cb84b84096c93da33f3a23bda28bcda638ec3a9256f4ab064d8bf6f1e2860d32e6713716f35803db92fb30c4f07b0b2accccd914d7bcb75910b63d79

C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\cab293E212B151FCAC5768C99D66AA8D9AE

MD5 f7bd3fbb5859bd43e830b621c8ade037
SHA1 71838fa41b8906bdcb9a64eec599dafd25d92c6f
SHA256 789ca746d45588380841494901a531abcf7a9a184f74af2cf049a77f489f4dc7
SHA512 53dbfde654e6bdaaab257fc3968a50ee7b8e4641bdc739c55ce1697e869ac513a7f2dc72ab92074b062928d56ab6f8083c5fa8a71a16a2f6918cc52f73b81250

C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\cab5DD1590118F3640F385DB3EB2F516E5C

MD5 b8b961c9899ec926b1dd8258b0232626
SHA1 8ed4a38e4a7c856a427a068ec51539f2e630f86c
SHA256 e9c26ae1625eb454e4cd78dd9ac145eeae94190f943b6fc72d250dc3acb703d7
SHA512 5dbcdbaf86bb25029838b93fa5787d9833b3ac2e6861b3df405b7957f1e5355395bcc664f4a550d9d79a7d3f7d98ca740527d5a86ecd0bfe0df3e768016f1877

C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\cab8D36E281ACA51D7FBE9AB973BE9B36E3

MD5 0102ec8e3aa2b964f2d7719dd00de809
SHA1 9a008c6acc5c70c8467621bf4a8e78930e2843a3
SHA256 765cdd18ca4b9c8de8f16035ab46f740a9da9e628f24dbfe16800af41fa3122b
SHA512 ee4f280449bcceb357290c1970914524fcb30931b240591cee3f540fbfe365a81f5d6201eee9e18598163f9be392062ee8cfcdf16d289c4bc2effa6061e69c94

C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\cab20036D21E40418DD3280D692958B9275

MD5 bed8b8bddf71f7b921c8efac0eb69518
SHA1 df2818992742ed4e80d28a94e1b0f43f280db455
SHA256 3cbfff994fa8a50b2d89e0dc906eefaf50ea16b07acb8ed4478fb2b116fcb8a5
SHA512 5699485985ea856d8ef3e97372e51c98eb81225c18ab5a851e1d8f574c0c9e77986563ad63e9b2118bd42edac0a39a46727306484be71af485955f9e818502d7

C:\Windows\Temp\{0B9D2AC9-8BF3-47DF-96D9-5ADA095B5CC3}\cab20F2A2993791BDD97B003B5578C7EAC7

MD5 951b5426340de231c90e0be2780cc66e
SHA1 fd6b966fd3270e53d8b1d660d69d4290b75b8a9d
SHA256 afac74f4b16fbefff34daec002a027abab8d45b6113ce1fde320cbf2b8eec68d
SHA512 038c0a171079502899366abf1101b173468a1a1997dafe94b6d217e26d5f6fec97e0d38fd4f7a70ef3d410dfdd18b7d93b3954776db3fc7ed9e91211492e0fb2

C:\ProgramData\FileCenter\PDFPrinterLog_000_PkgLite64.txt

MD5 833a96b8c3ab587dc0f92cbf82d7053b
SHA1 aa59423fdedb8e477afa46dc5f3e3680f703406a
SHA256 c9b7f3af374402bc2a5082b1dbd866bbea335aeb2bc1d4efe1b83d6ded458936
SHA512 129c1625663e7c7d5e5c6e2102128be842cfa9de247076a9b7a653b8f01e2e8e9456cd619290cd4457f1118fda6e412148ea8a74b23ff4ff64787a8fab73f827

memory/4852-754-0x0000000000C00000-0x0000000001696000-memory.dmp

C:\Windows\Installer\MSIFAA2.tmp

MD5 5a36339a5bae618a2ef09d0adab0b602
SHA1 437d251abdcfe4f9379c44336ff5b920df7a0fbf
SHA256 2e1d52eec9169247f75b584f874617ea4702cf2fdf92a4306d84c354a0151674
SHA512 cff119e5b719c8578d199b946fc213074d89195d63bf6cf00dc2c255cc66695d0062da2e916a22d4df4c1bb1e195f69df21c463d144ad9442defe7b3033ead2a

C:\Users\Admin\AppData\Local\Temp\prnInstaller.log

MD5 165ac3624305df2b7a64ea021e0313a7
SHA1 1b98afef131ae139b7262455634719a7cd512ff3
SHA256 220d6e9a9729274f9291e756ccb15c5b9d67148a3cff179931420d22fb5ee1d4
SHA512 0769e781396a9455d87db684dff36dff80e7b9b7bf855dd374d9fbeca38a9e70b5b8f3d939d23948cb43f186d505c824928780ce1e1b46345cf9b4687d4bcc8a

C:\Config.Msi\e59ca3f.rbs

MD5 1de3aaf41516327319caa6279ad97a69
SHA1 74b2088c42d97025e00949ce91c3cda3abf9bc3e
SHA256 12d75c8756059db788e1b1b27fb8bcd8c8b92b537fdfee654a9454944a0c1b4e
SHA512 ede6139203eeb4d4c95a8b57854e1fab10eb59788788d8ee3e284687ae6fe9c24748297b71aa5823dd5e4183773a29f95235bce22ec23f902220aafa43405a4b

memory/4852-972-0x0000000000C00000-0x0000000001696000-memory.dmp

memory/1000-973-0x0000000000400000-0x0000000000428000-memory.dmp

memory/3888-977-0x0000000000C00000-0x0000000001696000-memory.dmp

C:\Program Files (x86)\FileCenter\Drivers\InnoCA.dll

MD5 2fbf69d014ae135d473ec8243d44be9e
SHA1 2c28d3b23d8ff061ae554ccd92aec93900e3cb2b
SHA256 6f0d663f59487a01eebb128a9c4984789b91eaa764194ed9f0ed63583577d2d3
SHA512 530ab82b0ba1e148889bf41d6b00c67aee8ea4ff014b7e9d76bef682f8ce34a6908213b4d6f979ba02c6abe907cd1ac28bd323b4b766ede52b49ddd054d8b654

memory/2496-1033-0x0000000000400000-0x000000000052C000-memory.dmp

memory/1000-1034-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5032-1036-0x0000000000400000-0x000000000071A000-memory.dmp

memory/5032-1039-0x0000000000400000-0x000000000071A000-memory.dmp

memory/4184-1040-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/3108-1041-0x0000000002490000-0x0000000002EC9000-memory.dmp

C:\Users\Admin\AppData\Roaming\FileCenter\Settings\POLData_Lock.tmp

MD5 724deba0ee02aa7ad576295d784b1230
SHA1 f4f36556c9babc24a278f5f2ddcce4bff6a64bc7
SHA256 a98ebebe7123b54822d1250f6264dd8d971e47d5cc718fac967d2dd2374365ac
SHA512 3855cea9f71c3905baa510a42cf397da2b9f4f27cd071246e72911e646d6f5ba93fb120cb1a2f4d3e6a73d3d5ec40afc6dfbfb9e495e9bb9a2296930b1702239

C:\Users\Admin\AppData\Roaming\FileCenter\Config.ini

MD5 4a2b0b2d8d08db9fcc6eae2e25c9b4d1
SHA1 bcbd9242fe7ad0afabb143453d732657cfc79ede
SHA256 70bc9116d9db8cee6aaf87d19d323fc4961f90116b9a61281a981a461505974e
SHA512 5dc550410f15e4f64e637f61d8b6b09024b7502202ddd346463ac05b962d9bd6c3aecce6b85e089ca53184e99753cb2b137fae9ea26334d8044a0266742f6826

C:\Users\Admin\AppData\Roaming\FileCenter\MyPortal.ini

MD5 8af40c2a9db1af603163ed8b0e25a3d0
SHA1 36db1a9baec9e7d6d17073529afff9df063e68d9
SHA256 64b92b073e9519d07676100c694c63207f45b561ce66594b8728eae023ba0705
SHA512 2662a09e1cd148cbb4ee1124e4fdac6561699f447c986992651ff8fb8e7d005803b74ce5c1bb65c6f916ab1407894fabd453735c10378a94d5c918b1fe66688d

memory/5048-1141-0x0000000000C00000-0x0000000001696000-memory.dmp

C:\Users\Admin\AppData\Roaming\FileCenter\Logs\Hooks.txt

MD5 8df337bef20b7cbcee5140c12728e959
SHA1 61137a9481fc594d189690e52eeefece1db695d1
SHA256 1277271baa6ca0d75e070ccfb618a63de3fbf1fcd835957ffac23ab82a445b93
SHA512 1c533367d13f42ed2498eb0f5ca2e7702d0fcada7d00d6d45dee744aa945e3ed2c82738146b76f30a51da1d011de6ef440c13f6fab873bb82463c427a8a8222e

C:\Users\Admin\AppData\Roaming\FileCenter\Logs\Hooks.txt

MD5 f52673ec3b2b2ec654bc5aabce11ec44
SHA1 44762adf30f890f0b7810ea2474ec40d2decd38a
SHA256 2d89972def76be5aaa829d9f1bbaefa1ec420dc6f49c290117c602dbd59e528d
SHA512 ba2a397a4d5cf3976a798e3a44eec7a27863e82d8f4e6cad12d853e0f89f91f146700b7a5cbb40f227d623160755f2c177b43fd5494a319e404281780f19467d

memory/4364-1165-0x0000000000EA0000-0x00000000022E6000-memory.dmp

memory/4364-1166-0x0000000000400000-0x0000000000E39000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 23da8c216a7633c78c347cc80603cd99
SHA1 a378873c9d3484e0c57c1cb6c6895f34fee0ea61
SHA256 03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3
SHA512 d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e4bf11ed97b6b312e938ca216cf30e
SHA1 ff6b0b475e552dc08a2c81c9eb9230821d3c8290
SHA256 296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad
SHA512 ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b44ab87b0df99a8a029d918e452e6a63
SHA1 a4fb509c07523ec71eab8bad686cba8bd00f9cb0
SHA256 9e894d62c1f8b4e46d099db95f89de00e56f538f7a7d70a7aa607355b59d0f85
SHA512 ebef6d31faf97a029aaea6be0fd8fd24eb0f180064865dba2a1729c6e3c542fb7567b718968302166f630786320a06aa770c14492b8f210853f8e03fa02bf0d9

memory/3108-1192-0x0000000002490000-0x0000000002EC9000-memory.dmp

memory/3108-1191-0x00000000005E0000-0x0000000001BF8000-memory.dmp

C:\Users\Admin\AppData\Roaming\FileCenter\Intercepts.ini

MD5 293bfe23c32bd1332e4caf09e9bb347d
SHA1 1777f80e58dcc9b37cf87d73a4680723c7b87461
SHA256 3f6dd37419d2c2075812e0a104d0603d78a5cf1b378154e8d71c30c37de84264
SHA512 0ec00fc8b45d2fa205be404a37546772919f891d439e336dd601c0961355dd9afdbae983c254a9760207ea15b7b446b7b9d90ad93f7b938aeb74e838204be194

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9ab7d52f54e42804cd10deb6d15bd649
SHA1 2bf5442706ef424dd58ec1425f7988868a3da2b5
SHA256 1454a9d86a7a51c51ed02fad68578058d9543c2c50d6a8b4c547d78fa055e460
SHA512 ee3c922428598f7a5ce4b4ff80c0b9d4607a191276a11579500027ee1fe2035950cf996be1374054c54a4caa60fb10f536e31d552578a8db1db30aeb656c7836

memory/3108-1223-0x00000000005E0000-0x0000000001BF8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

memory/4364-1285-0x00000000022F0000-0x0000000002D29000-memory.dmp

C:\Users\Admin\AppData\Roaming\FileCenter\MRUSaveAsOpen.ini

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/3108-1317-0x0000000071720000-0x0000000071721000-memory.dmp

memory/3108-1319-0x0000000071700000-0x0000000071702000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 add56ec49f8f478e84a934606effef1c
SHA1 1262ae87ef755e40752740df90d21352d5fc81ec
SHA256 22e509cf2b7202fc6b04c3d9a1b137477f11471d58a48c1f9514f89450217327
SHA512 c095f193d221696f3b087c3f224a559ad0efe4852a5392c8a3ab03f80183beec2a8327892aa481c85f1bf8165b76a029555f250e0dd5f396c823feacff4c06f1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 5a639af7354cd034cf17f6432e208dfc
SHA1 0ef0245137b669c2c453e5eb91e11964dab51364
SHA256 bcd93ebc7fdf7cf6b6030f4fe3ee3353db68776744a4d1653b50c2f72db0427d
SHA512 1914bbf28b1cfd81f2ecf77e36348c7d48dfb1b26a7cf3ee2330ef1d091c8c91732ccffeaf37fc4da29bc7a04421ca4180379ec1ab0134c55dbb6e57e10115cf

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 52c37c936652f3d667a0a4a92abd9510
SHA1 e786f487b9ab7905e9a3c54999195ab5c057f68a
SHA256 0ce666675f34b1c298b64f4f233ef57e4a68160bf4f4a6d2f2cb1d58e4a42536
SHA512 28adc28e3c4612e1a1cf5c998db3195ab2050c465ca0ca27339830afda6ea471d7a01703056aceaa963aa0a45c8d2425196d5a5529717e3bea63dc89a02c9b1a

memory/3108-1466-0x0000000012120000-0x0000000012128000-memory.dmp

memory/3108-1467-0x0000000012A40000-0x0000000012A4A000-memory.dmp

memory/3108-1468-0x0000000016C70000-0x0000000016C82000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 55336d6efe5d3fbc638965ea69ec5bd7
SHA1 054559c8fd0e23a85077d5681921b4fe6de84236
SHA256 ec90601f2f5a4de1ae640128a2d6164bbd401c46e1ff8337011166cea4e308ac
SHA512 7bf2478b8f8cac5c711e9603a0efefa8ee8a9bc8b6bb6f9dfe8002d92abe96c15d7d2fe9d4fe7966c6b8812934373f5c11f4d4c4c8b3520fabaa5fdb970ab877

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 65ab29c80b7490eeb5ee1df3d3d8d141
SHA1 12c12421e3461e48beebaf6dee17206e5c163f0c
SHA256 75be4b0e5d98df19c6e6202166cab26490e8eeeb2fa4ccfce69321f64d479ee3
SHA512 c8c68d341809a5cf65abd6ba0813f1dfe3f3b72e2bdb167735ba4fcd4054e719dad1c9249d3e41124767951b5f83efdebb4ae4255909efbe4c0049e0d4fe74e1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 fae15c80412061ebb343902a94091e7c
SHA1 2ad87464e4c25c3dd9bef973fb095e20c5e65456
SHA256 4257736bffabf78d7d0fad3b1137adb94ed3a29c58518bd16642daacf547f41b
SHA512 d7a7b2bccbfda5f7f919ef51764bcee235023ece123b821204921364344af0f6fb9a893965cc040f60ccbafdf419d357c6e295c11fd27266d5a1c02fb76bd16c

C:\Users\Admin\AppData\Roaming\FileCenter\SAOPaths.txt

MD5 98ed711013950aec82173a83449b1853
SHA1 71e8fbe024c3ec7203d2fb4cbcb8470bdc334d49
SHA256 76e4a28af7322c646686cdc2fda31e86c926677995e87e0f217244f2c4f09f0b
SHA512 a8cfbdcdaeaa2340aae2aa56a2b88f46e59e8d4de6929041bd02dbd8e8e988080ab17ede546ef5c0231f4b0f6512a6b5cceeef74b551a41c3050fcc65de18542

C:\Users\Admin\AppData\Roaming\FileCenter\ColumnStatesCab.ini

MD5 3634333c0e07b66358752d92c67c8670
SHA1 ccf76414b160330097f13e70c9ffd855480996ad
SHA256 c136ecd2939792c7d6831c9ed5326010f9691d2d7e9e9adf921ed022b3ccf1ab
SHA512 10eba20ba958d2479e91c56d75e0c9735e9b6781470383cf55a56b45d8d54249512b33cb505fdb3486823e652ca299003578e42b56b79e6ce89f190e955a5dc2