Malware Analysis Report

2024-09-11 16:46

Sample ID 240621-sknjrsygjm
Target FileCenterSetup12.0.16.0.exe
SHA256 df2b7f274c484ae5baecb3365b1d9fcc4821facf327ce87724b1be597d0c70a9
Tags
discovery persistence privilege_escalation
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

df2b7f274c484ae5baecb3365b1d9fcc4821facf327ce87724b1be597d0c70a9

Threat Level: Shows suspicious behavior

The file FileCenterSetup12.0.16.0.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery persistence privilege_escalation

Blocklisted process makes network request

Enumerates connected drives

Drops desktop.ini file(s)

Adds Run key to start application

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Drops file in System32 directory

Drops file in Windows directory

Checks installed software on the system

Loads dropped DLL

Drops file in Program Files directory

Executes dropped EXE

Enumerates physical storage devices

Modifies registry class

Suspicious use of SetWindowsHookEx

Kills process with taskkill

Suspicious behavior: SetClipboardViewer

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Modifies Internet Explorer settings

Enumerates system info in registry

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious use of SendNotifyMessage

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Event Triggered Execution
T1546
Component Object Model Hijacking
T1546.015
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Event Triggered Execution
T1546
Component Object Model Hijacking
T1546.015
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-21 15:11

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-21 15:11

Reported

2024-06-21 15:26

Platform

win7-20240220-en

Max time kernel

170s

Max time network

168s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileCenterAgent = "C:\\Program Files (x86)\\FileCenter\\Main\\FileCenterAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileCenterAutomateAgent = "C:\\Program Files (x86)\\FileCenter\\Main\\FileCenterAutomateAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{3780ab31-c524-4f3b-a4db-79d692700a62} = "\"C:\\ProgramData\\Package Cache\\{3780ab31-c524-4f3b-a4db-79d692700a62}\\PDFXLite10.exe\" /burn.runonce" C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Windows\system32\MsiExec.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\DRIVERS\x64\pxcdrv.xml C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\PXC50f.DLL C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\PXC50UIf.DLL C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File created C:\Windows\system32\pxcpmL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File opened for modification C:\Windows\system32\pxcpmL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\pxcdrvL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File opened for modification C:\Windows\system32\spool\DRIVERS\x64\pxcdrvL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File created C:\Windows\system32\pxc50pm.dll C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File opened for modification C:\Windows\system32\pxc50pm.dll C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\FileCenter\Main\Dlltwain.dll C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-9L5DU.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-694L3.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-AP3M1.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-K26GJ.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Tracker Software\PDF-XChange Lite\dinfo.dsf C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrsasian315.dll C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-1LCMN.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.pt-BR.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.lt-LT.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.it-IT.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\Temp\x64\PXC50uif.dll C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
File created C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\Win32\is-O1DAL.tmp C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
File created C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\is-DSAAK.tmp C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrspdf15.dll C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterAdmin.exe C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-P79CN.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-62G09.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-DT2BV.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.da-DK.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.zh-TW.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Tracker Software\PDF-XChange Lite\DrvUIL.x64.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-5DTK6.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Tips\is-QUNU8.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-V0O31.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-AHB9G.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-H9A62.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-NGT23.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\GdOCR\is-M4AQH.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-04DFP.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Help\is-JIGN4.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.ko-KR.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Drivers\is-A0NNU.tmp C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterIndexer.exe C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\GdOCR\is-0L0NS.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-LH8QS.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-STH0C.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\pxcdrv.xml C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\EZT4Symbol.dll C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-K7B9E.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-LNC00.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-UVTI0.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\EZT4Tiff.dll C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterOCREngineRI.exe C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-0CQD8.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-DMGFD.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Tracker Software\PDF-XChange Lite\Help\PDFX10ManLiteSm.pdf C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrsjbig215.dll C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-3IQU7.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.sw-KE.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-EDH4N.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.fi-FI.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.tr-TR.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.hu-HU.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterOCREngineGD.exe C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\ISYSpdf6.dll C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-LK9IT.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-CHDTT.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\Temp\win32\PXC50pm.dll C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\GdOCR\is-UV7AS.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-IOR4O.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-4S7UP.tmp C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.zh-CN.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.fi-FI.xcl C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\f77372a.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4379.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\Installer\MSI3C9D.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3CAD.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{6318D993-1BE8-4BE4-B9E9-D6BFED11A071}\AppIco C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f77372c.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3C0D.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f77372a.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3DC9.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{6318D993-1BE8-4BE4-B9E9-D6BFED11A071}\AppIco C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI41A2.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI42FA.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\Installer\f773727.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3C5C.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3D7A.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f773727.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3C6D.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3CBE.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Windows\Temp\{F7B8032F-120A-48F7-86B7-F2F85E1ED1E0}\.cr\vc_redist.x86.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe N/A
N/A N/A C:\Windows\Temp\{A74A5462-189D-480B-920E-AB04081F5FE2}\.cr\PDFXLite10.exe N/A
N/A N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe N/A
N/A N/A C:\Windows\Temp\{F7B8032F-120A-48F7-86B7-F2F85E1ED1E0}\.cr\vc_redist.x86.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe N/A
N/A N/A C:\Windows\Temp\{A74A5462-189D-480B-920E-AB04081F5FE2}\.cr\PDFXLite10.exe N/A
N/A N/A C:\Windows\Temp\{A74A5462-189D-480B-920E-AB04081F5FE2}\.cr\PDFXLite10.exe N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\AppName = "C:\\Program Files\\Tracker Software\\PDF-XChange Lite\\pdfSaverL.exe" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\AppPath = "C:\\Program Files\\Tracker Software\\PDF-XChange Lite\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40} C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82D9E0B1-2FE2-11EF-9680-DA96D1126947} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\AppPath = "C:\\Program Files (x86)\\FileCenter\\Drivers\\PDF-XChange 5\\" C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\Policy = "3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e0cc59efc3da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001bd18e5f884de44a860c31ce68eba50f00000000020000000000106600000001000020000000c5bb36ab4e5b46ecc293c23d038798c6da618f07a03d10412a93defb8f3ea22b000000000e800000000200002000000051e3f91cce0118a52749516104bbdeba9143a0caf4bd01e6305226545814e5a420000000024688c0dac948d1657701b70caa3b05caf907f9e3ba8223d66afa3592d88b79400000004bb7e556cfb6474f296df0268b8f73d6f0e95d365463524ac616e9fbcfa1eddf8d5c2882b6b9f1647154cd527ef7079d7a5a8bfe713e5cf0bf62a97e1e5a62db C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\AppName = "pdfSaver5.exe" C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001bd18e5f884de44a860c31ce68eba50f0000000002000000000010660000000100002000000090036b7d698d351a04fdd4dc4aa41eeac7289ad32abd788fdb14eae9dc050fab000000000e800000000200002000000033690ccc53d7007756b54f82f35a1477875c8929083e568bf270dfacb874f38c90000000736eaa8a84d674d0304896cb565e534c75ec23c906d0d7b1fc8f0059fa260615c0261562200ed5c8633b5faed534bbe006ae9b60ce2843ca37aa438d732cffa07f4ddd96b1fd165664256b530801f399bbe233fc3db6a8d690c80258c0778d5fa6f11cf6dfd2e5e6ab49ceed804cbc09297fecb91cbef4a39c906016f821e0b6b3becc08f374165896dbe4c9ddd69aba40000000fc7087c4014dcfc7721bd57170687ddaee668660f047ab94d8b844cfad299e60e7c9e5e2310f15a1c55ed10802a7615d4cd85c9a4c185fd653ecd3dda78567a3 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D} C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{211AAF91-E97A-454C-9669-EDAEC904E16D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CBD34A5D-CCD7-47B5-B8D4-121D40FA0934}\InprocServer32\Class = "GdPicture14.GdPictureOCR+SpreadsheetOptions" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CC0D923-B9ED-310C-B453-D1A59F25712C}\InprocServer32\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5037219D-F496-3D35-8258-B9B561BF622B}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E8C2F816-B4B2-311D-BAA8-EF842F78E378}\ = "_AnnotationRectangleHighlighter" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72D158D4-EAF7-4894-A5FA-719C705800EB}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AFC06F6-7848-37B5-8044-97A2EBECF8BB}\MiscStatus\ = "131473" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE4EB426-7321-3D5B-A255-694F9D887551}\ProxyStubClsid32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B6835517-900C-37F4-B861-936E79F91A48}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF67F023-1C25-481D-8EE2-D522FC578CC5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7B430FB9-7FBB-4645-94BC-76E917FFCE42}\ = "IPXV_AttachSelection" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{73075CBA-0FA9-4A85-9922-EE773B6C9FDC}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F279E381-71DB-39C4-9419-EF92C8FC045D}\TypeLib C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C47EDD9-60A8-3CE6-B254-40B8B31C854F}\TypeLib\ = "{B5893B58-701E-4110-9871-1DA14CF9C1DC}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{32396BA9-AE47-3B2B-93E0-A968D7D41BF3}\ = "_ViewerMouseDownEventHandler" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6D67878-15E2-4488-9981-2182B0652E8E}\ProgID\ = "dtengine.IndexCache.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{999A6C12-A602-4601-9866-0B9AE973B7F2}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CB4C389-2562-4339-BD98-EBB158192D61}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{426B5317-D5C9-411D-A518-E026C137E3F0}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49237A9D-448A-484D-9036-73E1E6C36628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B5893B58-701E-4110-9871-1DA14CF9C1DC}\e.2\FLAGS C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{107507E4-8258-4E89-9167-CADCD46059BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}\1.0\HELPDIR C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4512B1B5-4B43-3918-8EFB-7C83CEA6B90E}\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0A8E6A2C-43A6-48FE-953C-4668DC9F0352}\1.0\ = "PDF-XChange Printer 2012 Type Library" C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2A36038D-FA98-43A7-8DF0-5A9916167753}\ = "IPXV_CommentsView" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51DE5D08-F43E-386D-AE8D-9A8EEF3C7B60}\InprocServer32\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{71974BB4-B316-3AED-94EA-A56531C19665}\14.2.69.0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63375FB3-4F89-42F0-8090-209E954EBA1A}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91F594C1-7C1A-465D-BC9C-004E2FD7C6C4}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0BCE7AC-1387-4C70-9184-912EB94AE3ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6554EA2D-9436-4F25-8B11-A4CB7C2608DB}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F114962-0BD3-46E4-9128-B8AE21D8BA5D}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4862F192-136A-4700-9F1D-0B6164A36B99}\ = "IGdPicturePDF" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A46B9230-3A18-3180-9BA9-1D063B9DB1B7}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBED514A-A877-398F-AE2A-A1EDE5F43724}\ProgId\ = "GdPicture14.ThumbnailEx" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AFE955F3-4ADE-4C79-B40A-8DD1955A328F}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{17AA9FC1-A869-38F0-A7FF-A720437AD51D}\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C15E43AE-9519-3E72-81E6-6D527D4E2BD3}\14.2.69.0\Class = "GdPicture14.ViewerZoomMode" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD74E532-D113-3F50-A247-49926E0C6476}\ProxyStubClsid32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{419BF6AA-AA35-3FBC-B01B-554F71547437}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D513F74-9FC7-4179-A268-92E62D4F03A7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9DCA6E8-8C23-4765-8305-C58DEF3E27E0} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A79755A3-8507-48EE-A616-611BB01CF94B}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3F5231AB-AF92-4184-A361-5A3307A3464E} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8B148BBD-F357-4166-A073-16B44503B6AC}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B55EFD3A-7639-45F0-A33E-12971B7DAAB7}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EAC43C65-FF9C-360C-99E2-51908F1A60FC}\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{164FD132-B662-3C32-8443-A7B8CAD07EB2}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96B2AE5F-BFDE-426A-A8C5-A7489C64F0C0}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53674462-76AA-41A3-A5A3-5241912E4222}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{092DCFE6-4B0E-4392-A71A-137E9F5DBF17}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{96B2AE5F-BFDE-426A-A8C5-A7489C64F0C0}\ = "IOperation" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3875CE8-36F6-3C53-8790-00366D3EA1FB}\TypeLib\ = "{B5893B58-701E-4110-9871-1DA14CF9C1DC}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{50B4C2D7-BD1F-3AA0-B81F-8C1054BC813E}\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{209EE7F1-1F4F-49EE-9F26-01D7118E48D1} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CBD34A5D-CCD7-47B5-B8D4-121D40FA0934}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CEB68BB-FEF5-3F6C-9F82-7C6B1F524A3F}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1FB2340C-1E2A-3B9C-A78E-28C55F46EC7C}\14.2.69.0\Class = "GdPicture14.PdfDocumentMergingOptions" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB2B171B-0765-3453-975D-05DDFAC1DACA}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C0F85EB-00C8-33F4-8407-D77C223841B9}\ = "_ItemClickedEventHandler" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6E200759-C46D-3822-A83A-11C96FC94477}\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{879706ED-6E59-32EA-9C05-FDC9D5CFB7D4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{879706ED-6E59-32EA-9C05-FDC9D5CFB7D4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A C:\Windows\system32\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2872 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp
PID 2872 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp
PID 2872 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp
PID 2872 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp
PID 2872 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp
PID 2872 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp
PID 2872 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp
PID 2972 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2460 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2460 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2972 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 2972 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe
PID 1544 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1544 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe

"C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp

"C:\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp" /SL5="$400F8,314098152,831488,C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe" -S -INFO "-1" "3" "11" "C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtilsInfo.ini"

C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe" -S -INFO "-1" "3" "11" "C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtilsInfo.ini"

C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe" -CLOSEALL

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterPortal.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReceipts.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReports.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileAgent.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe" -INSTBEG

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterPortal.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReceipts.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReports.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileAgent.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -INSTEND

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\PDFXEditCore.x86.dll"

C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe

"C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe" /silent

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\dten600.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\lbvProt.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\VSTwain.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\secman.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.dll"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" /s "C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll" /codebase /tlb

C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe

"C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe" /install /quiet /norestart

C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe" /install /silent

C:\Windows\Temp\{F7B8032F-120A-48F7-86B7-F2F85E1ED1E0}\.cr\vc_redist.x86.exe

"C:\Windows\Temp\{F7B8032F-120A-48F7-86B7-F2F85E1ED1E0}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /install /quiet /norestart

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -PRINTER

C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe" /quiet /norestart /log "C:\ProgramData\FileCenter\PDFPrinterLog.txt" PNAME="FileCenter PDF Printer" ORGANIZATION="FileCenter"

C:\Windows\Temp\{A74A5462-189D-480B-920E-AB04081F5FE2}\.cr\PDFXLite10.exe

"C:\Windows\Temp\{A74A5462-189D-480B-920E-AB04081F5FE2}\.cr\PDFXLite10.exe" -burn.clean.room="C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /quiet /norestart /log "C:\ProgramData\FileCenter\PDFPrinterLog.txt" PNAME="FileCenter PDF Printer" ORGANIZATION="FileCenter"

C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe

"C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.be\PDFXLite10.exe" -q -burn.elevated BurnPipe.{18C06755-63CA-48A9-A4D6-12D4023A83A8} {5199C2FB-1E3E-4618-B361-042DA0B70CC3} 2000

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" /s "C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll" /codebase /tlb:GdPicture.NET.14.64.tlb

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\DrvInst.exe

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005AC" "000000000000059C"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\MsiExec.exe

C:\Windows\system32\MsiExec.exe -Embedding 89A5DC51A720C4B7CF49714EB6F329A1

C:\Windows\system32\MsiExec.exe

C:\Windows\system32\MsiExec.exe -Embedding 86C7E9FC29AD32D4819CB2B183B12ED7 M Global\MSI0000

C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\\PrnInstaller.exe" /L /I_D_R_M_P /F /N "FileCenter PDF Printer"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "FileCenter PDF Printer"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "PDF-XChange Lite"

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -DRIVER

C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe" /VERYSILENT /NORESTART /NOICONS /COMPONENTS="pdfSaver,PDFXChangedriver" /DIR="C:\Program Files (x86)\FileCenter\Drivers\" /PName="XChange Internal Driver" "/Organization:FileCenter" /LOG="C:\ProgramData\FileCenter\PDFDriverLog.txt"

C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp

"C:\Users\Admin\AppData\Local\Temp\is-0V1CP.tmp\PDFX5SA_sm.tmp" /SL5="$300D0,5384545,119296,C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe" /VERYSILENT /NORESTART /NOICONS /COMPONENTS="pdfSaver,PDFXChangedriver" /DIR="C:\Program Files (x86)\FileCenter\Drivers\" /PName="XChange Internal Driver" "/Organization:FileCenter" /LOG="C:\ProgramData\FileCenter\PDFDriverLog.txt"

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe" /W0 /I /N:"XChange Internal Driver" /Base:"PDF-XChange "

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe" /RegServer

C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe

"C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe" /install

C:\Program Files (x86)\FileCenter\Main\FileCenter.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenter.exe"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "FileCenter PDF Printer"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "PDF-XChange Lite"

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -OLOFF

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.filecenter.com/action.php?Action=Welcome&Refresh=1&ProductKey=&KeyID=-1&PTID=1&SourceID=-1&CustomID=-1&VerID=-1&PartnerID=0&WelcomeID=0&Version=12.0.16.0&CN=BISMIZHX&UN=Admin&Trial=0&DaysLeft=0&s=&cnt1=&cnt2=&cnt3=&cnt4=&cnt5=&cnt6=&cnt7=&cnt8=&cnt9=&x=1235

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe"

C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterInjector32.exe" 600

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.filecenter.com udp
US 98.129.229.7:80 www.filecenter.com tcp
US 98.129.229.7:80 www.filecenter.com tcp
US 98.129.229.7:443 www.filecenter.com tcp
US 98.129.229.7:443 www.filecenter.com tcp

Files

memory/2872-0-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/2872-2-0x0000000000400000-0x00000000004D8000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-ALDUF.tmp\FileCenterSetup12.0.16.0.tmp

MD5 0acf3c16e6faca9c0aec525f53d03866
SHA1 5c3960b48d2b72ad02e59470d8a7b690ee826f9e
SHA256 2c470730bf3efa3f4a9dc184548abefbab8c4aecc43e14834c5810159019c151
SHA512 17d98a3b52eb89e02a371f1d6effa59f624696cd14b0589fe436640ddbe04fc6c5d82834f73699dbaa32a7a69343f82863820e72e225e17d710c4de5102b46c2

memory/2972-8-0x0000000000400000-0x000000000071A000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-PK3UA.tmp\FileCenterUtils.exe

MD5 e9638374a27160513f1a62827b6cf102
SHA1 b9da58896020d46c4ef16f8f1b332d5f6c1e6f0f
SHA256 c064ba394872e6a8277a5c71b50da34b800d682e403c6b80ec3ba37badf38942
SHA512 9632c8416f542dc96f22a0ddcd109e85c29368b1263d86f74bab39aae8e9271a7b3e2eea18932cf4e3fb5e269d3892016b878d29fb6dad002db11367849f293c

memory/2636-16-0x0000000000EA0000-0x0000000001936000-memory.dmp

memory/3068-19-0x0000000001030000-0x0000000001AC6000-memory.dmp

memory/2872-20-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/2972-21-0x0000000000400000-0x000000000071A000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2460-25-0x0000000001160000-0x0000000001BF6000-memory.dmp

memory/1544-28-0x00000000012B0000-0x0000000001D46000-memory.dmp

memory/2972-49-0x0000000000400000-0x000000000071A000-memory.dmp

memory/2972-118-0x0000000000400000-0x000000000071A000-memory.dmp

memory/2972-346-0x0000000000400000-0x000000000071A000-memory.dmp

\Program Files (x86)\FileCenter\Main\FileCenter.exe

MD5 879d5b401a73cc57a3166ba01ce70c60
SHA1 ee8b47af48514a3b65f4ee838c95e7a3a64d3434
SHA256 82da544c9d730c17c34a253c29fd7d621e8cdc064e0220c27e43bb0dd60c4ebe
SHA512 6e49343acca8ab878b4cf9e12ce4d796decd7f44c7068f8d90f5ad2eebbab31c15c82bbf66bcb571120a9bf8e375055558308d00b66053591c6ec94fb514b3b6

\Program Files (x86)\FileCenter\Main\FileCenterScan.exe

MD5 48c0dc674559c958633f98b057ebcf26
SHA1 07af2ae436c357cf1ba508f0825654100cb56c07
SHA256 7dcbb120bff0e4eb3e1964c56de1d528810a64b28e224fe9f3bc1d65e15cb896
SHA512 7ecadbfa6ac7fdcdd274cee98329c614f3c387aaff658b163349ec4a42f782a8dcf7c1528ba0cfea362bf9b43c80f3e6aaf34f414767da51d3b2c3b425aafa00

\Program Files (x86)\FileCenter\Main\FileCenterAutomate.exe

MD5 b54c915c76810bd4ae1cacf3f60d3fcf
SHA1 348c04cd0057b2e12c64ae8911533ef9046a786b
SHA256 1d98350a7cd23ca173b6405ce46fe002f8ca340cd7362a1dd90927508ae37459
SHA512 dd8199c6edfe413d332c5925d75aea74ae96d8ff1efa323e57ca69c23065904b2db715b6af413bcca9f99b33280dacee24c695bf9cf61bb9dfae38112e9534ee

\Program Files (x86)\FileCenter\Main\FileCenterPortal.exe

MD5 b117c8ab833f3fd2e645588b76e0350d
SHA1 542f9f159f61c53b6bddf3c12ee599f841894032
SHA256 fc84fcca5174673afc19102cc1ece6927f340a5b787602ae7c8487dd48af0183
SHA512 d662b913d390ff27cbecde257f6a3b873d8727df9d83fef57cce51be744e9748b18471b24af23adee36772ac5df7605a411b158c5e0aae276a55a4cff3117ef1

\Program Files (x86)\FileCenter\Main\FileCenterAdmin.exe

MD5 30a169811bbb56f80ad2ef63bafd48bf
SHA1 61006f10a4ec28c8dcc2f19485306a349e65d82c
SHA256 5e6a19aa1448fdf5861b3a663d81e149582c65022d31020cad58e71943d850b9
SHA512 149df30e330b61345562bf5f6cdd313b73df3386cccfe0d56c178daa5172c10b120bb3bc9a6ce9de935772466c76af03cba9c399f1b60bec0470ec2ba9ffc9e5

C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe

MD5 b9718823c993fccb6352cc0210993569
SHA1 4d551f7cafd0040ff9657ca644c1365f3e7847ae
SHA256 a173ba320929c93b9bf41186a0692d753da812b8691dcc416c16abdf004dbf89
SHA512 6e513ef7535539cff90e88b95c5f57bb9e262cebbf1e51bc8268595347fbf06f628cf16eaa974d7eccd2a285ff2f8f56867c4292c1fe4fb7b0ee90f5acee9747

\Program Files (x86)\FileCenter\Main\FileCenterAddin.dll

MD5 2b9bbd88d6b6a3b7c417cbb0eae69bf4
SHA1 c43ab9fa5c1085ba21280d143f8b8322d6a93883
SHA256 1e5f8dbd4c08faf3a0a84b6af17454d9d21459618b411696b9604af80ee9fc0f
SHA512 f07ae3e76066960a3b657146b83da724ca13873edd82d7314d048593c3e6021ced3297459d46a30daf95189631bfd4c941e44d91433549dcc70efb5407543a30

memory/1464-578-0x0000000010000000-0x00000000101C8000-memory.dmp

memory/1620-574-0x0000000000E40000-0x0000000000E48000-memory.dmp

\Program Files (x86)\FileCenter\Main\lbvProt.dll

MD5 120387e48d0556538ef3ee68de18a707
SHA1 0633de57f7ef851115be39d407db8e08986b3d93
SHA256 e202172ad8799ee0feee2559ac06f2cf75530f702f7e11d0cb4c1b3ec57eae4e
SHA512 a7509c2822bd7f08b5e67dfbd3d9ac701639599b5681966f5276f51e60608dcd7dafaa953f7589d99de7ba7b68eaa56be0ecb2c074f5c4ba6ba114880507b1da

\Program Files (x86)\FileCenter\Main\VSTwain.dll

MD5 13f5f7e228ce2b8a3a41dbad4e451279
SHA1 1b3837572602b2620b75bf2ad2aeab89a64f5287
SHA256 11b50ff0bc4e72cd2dd47fb8070a86781682b92a9fb1010a5fae97276afb2292
SHA512 24ea8072abb5c0d4083989539f399ad076cc92260aaf0317320dddb4196e752e1c082d386c75049a343b1c62765d587f2b66374b53e7b24326ee6129a7aa856d

\Program Files (x86)\FileCenter\Main\dten600.dll

MD5 22cf875a0cf0ad89f5f7d7ac6628a598
SHA1 c2a9620579a08d6a91557e6cb8f1d2585392d30d
SHA256 11ef1b8791cfd8fee0923ec685ae1d29485349ce7d2d37a15ae1615e8d646baf
SHA512 3b59898730a9eb4a8f4347b8c854983636b28f6641b072fdd0d7f9190b905fc9b03dcf204154072048dc1a6a24785d2aead865b5bf160c9af9df87cf4175c608

memory/2972-577-0x0000000000400000-0x000000000071A000-memory.dmp

\Program Files (x86)\FileCenter\Main\secman.dll

MD5 085d87f49daf13496e0e018c4008fae6
SHA1 4b0c3058b8ace7e8242c941b449daa968f5b45c7
SHA256 d1f1e3717a68166942d1f7a71b78e35e3381edbb07d7d37ae8b603dcc3ffad15
SHA512 52886de13e538e0eef364a16da1ccd24a571450d417ead4ddb689efe8e8099f9964c5f6076a239e833bd41c88f2f95f30c20d722f880837aa541be366407145b

C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.ini

MD5 70da425f8aac14b1484047edb83e60e8
SHA1 69d09199af5a5ba4ed4e1d59432fec784d5271e4
SHA256 258d4ad31457b1c117b248b6ba0dd1c44ba6ad0a0839623ced45ce15ebbd0a7f
SHA512 a9cf352b79a8f38f03a781bf55a94e2c1344e1de55e9ea21e736ad436d7452f8349a64fec3b46e7ddc1d11f5fa3ecc80329b5b4e1da702680e9c2223e57943d2

memory/1284-582-0x0000000001130000-0x0000000001142000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll

MD5 d9806fd0eeafd9f89e0473ad52889283
SHA1 d6fca558897aaa6703129557e2d02b1a84765dcb
SHA256 aa2aafe588aecd1a10bf05dcd675143061a55bcd5bc83bd749bde7b85d21dbc6
SHA512 796c609dc6fa4c6fe1e6909ae3a4a22cc06c900f34b999d77a9805767f69f1b1d96a99e9ee03ad6ab68e7f6bb5fa3269c1d73db4af68a2834bfd5cbf2fe91422

C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe

MD5 35b40b21383ac38487ceec8ab6e53565
SHA1 59894bd9c96361b475c3b4b7ca9719c72e813d04
SHA256 caa38fd474164a38ab47ac1755c8ccca5ccfacfa9a874f62609e6439924e87ec
SHA512 3a00b40ba8cd1cf8a523efab656f5b8910a3b07f9d8fba4ffc07745165b6375affd77b00fd3064fa72fb984c1773438a39e67a55363be23dd8fe1727c1016b8e

C:\ProgramData\FileCenter\Config.ini

MD5 b2ad8f8dcc45644ea167317d050faac4
SHA1 215091d6ad9d4f210b85e675b17c60a7300ca9b1
SHA256 9aaebe4ab06e9de08e28b9b4da9248442c502ef5411d7d734c13af1afa2c2dd0
SHA512 528737e85d799e0312c335bbbb856f12ee885465e9b999d6cfb1b64d8c003744a5a6d6cd7ae2b6e41b9cbe23115990acd65debfcdd15e1677c955944403da6f4

C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe

MD5 42d9ffbb0b7ef3cbdeb0c005619b12fb
SHA1 fbaed95c25aa26c43121e8421b5154e9e5dcdca0
SHA256 59e5b75c18c82acf2d94a1fd9b0a67af6795d594e1f837df1a80eec66671d307
SHA512 c77b91ca41b13bb471ced5346f998805430a33e210c09c0d7e0b0a7573d9e95da1bc5e351df08c871e1c3e962b3ec4b9fdb5ef5cc806fd87ef42f50ddd99d7cb

C:\Windows\Temp\{F7B8032F-120A-48F7-86B7-F2F85E1ED1E0}\.cr\vc_redist.x86.exe

MD5 86123c033231dd7e427d619ddeefd26a
SHA1 608c085348fd9c4e124e6f28f0388ccdac6ab2b5
SHA256 d863fb2f65bb6eea492e79ab9d09a53cc226e85f57d6545cb82f60b122a4b737
SHA512 ffb574123b350d3c9434abc88baa050ae6e54b5b9ebf3f1dcf4bf079284135696004508653e74a3a3c2fa8e4c1b681c3f31d5fe69e0f0c5f45ed37f9ddc61e78

memory/2112-639-0x0000000000F60000-0x000000000171B000-memory.dmp

memory/1284-640-0x0000000005230000-0x000000000771A000-memory.dmp

memory/112-630-0x0000000000310000-0x0000000000DA6000-memory.dmp

\Windows\Temp\{96DD5E03-841B-484D-ACEC-E8694ED3005A}\.ba\wixstdba.dll

MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

C:\Windows\Temp\{96DD5E03-841B-484D-ACEC-E8694ED3005A}\.ba\logo.png

MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

memory/1284-686-0x0000000005230000-0x000000000771A000-memory.dmp

C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe

MD5 4c61ee01d5b84db67c38c10d3f210f39
SHA1 844eab66505dc4eb88dec70c3f20307365c350ac
SHA256 a7e10bda5cb2e1c347b2ee682385fd56ff5da05c659c665abc0b526f639a5583
SHA512 a44a2bd871c9f0f654b0e627accc9d4388390e5e5b7326a3372a103886d74b89ab78e235e1b986da9acf0f08fdf45b642ec26000bbe32de92a44b1978f4c2f80

\Windows\Temp\{A74A5462-189D-480B-920E-AB04081F5FE2}\.cr\PDFXLite10.exe

MD5 63ed90cdd501829a2319f8cf86c52bd2
SHA1 da198bec49015e98baa5b2cb91903f659e31dd37
SHA256 529bcd90e571d51a19396cb457bf7eebecf494613030389fa7c5b25b8e42757f
SHA512 d8cc05a5d481e17432125d21d58c2b32696c8b3e6632f911184292a0f0b24910e9dc5cc3ae2bdc6d87e478aef81504aa34520d3bd6813517e4b9347eee0eaa19

C:\Windows\Temp\{693C9D01-5A93-4FB7-B90C-3916D01A8397}\.ba\logo.png

MD5 04967ef5107480ea36b3e2e97af7eb7a
SHA1 6efdd4484dcfcfd45b3c887c852f0abb1a02a645
SHA256 63f2616963b68ac13dab898c1b5938ab1b353a9ba0f73c6a2f2c3c5c9eac0b21
SHA512 00ae4cff10b1a6e504d590d49bc4af707ad33c1739ed46f648dc348645bd5d4b61bf0c84448c78d7542fb6d7294f3aa753b4106579f15b1d726bf1118594c581

memory/1284-715-0x0000000007850000-0x0000000007858000-memory.dmp

memory/2504-719-0x000000013F620000-0x000000013F630000-memory.dmp

memory/2504-720-0x000000001C0F0000-0x000000001E5DA000-memory.dmp

memory/2504-721-0x000000001C0F0000-0x000000001E5DA000-memory.dmp

memory/2504-722-0x00000000005F0000-0x00000000005F8000-memory.dmp

memory/1248-724-0x0000000000D60000-0x00000000017F6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab37B5.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar390F.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar3A5F.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Windows\Installer\MSI3C6D.tmp

MD5 5a36339a5bae618a2ef09d0adab0b602
SHA1 437d251abdcfe4f9379c44336ff5b920df7a0fbf
SHA256 2e1d52eec9169247f75b584f874617ea4702cf2fdf92a4306d84c354a0151674
SHA512 cff119e5b719c8578d199b946fc213074d89195d63bf6cf00dc2c255cc66695d0062da2e916a22d4df4c1bb1e195f69df21c463d144ad9442defe7b3033ead2a

C:\Users\Admin\AppData\Local\Temp\prnInstaller.log

MD5 84ba1acd39fc52eb3159386e13d5861a
SHA1 2f053d9f7f3aa4257d0164fa18fbeef8083ab72a
SHA256 98e2e2747f52d7bcc4d1175dda6cb16cd7e8e07139e0c7788061b3c078cc85c0
SHA512 4e62247f8966400beffd7c061656eb4d5c7b84d916802a5c3f7ffdb1766770279addf6f029ca850ec084520b4ee7dd4a8fc2963c085cbe291c09bbc3e2d975ab

C:\Config.Msi\f77372b.rbs

MD5 538eb3f93fba806ef8d7e066cbe39b63
SHA1 06e2a54e6b06f9812b99f1a704a0fb72fa3dbcb1
SHA256 859f6817194de756b9f890b976966b4ac54053643348a58a5c62d7720c71335a
SHA512 dad9579abb2ececd25083ac9f319298f58e4517effcc32b169ba2225cb6198081707a828a4a7233c16451c6278f7cac02815073a7ac4eb7bb8c5a8a86e578dda

C:\Windows\Installer\f773727.msi

MD5 e91e50fc80f7d84561db5823595e5b63
SHA1 b3e40b17a668586e86f346e9a7e3b8ef4838d437
SHA256 3203656dcafaf1ae128dae78bab26829bf0c2c9e1c255a8ca15ed176651d8948
SHA512 c9bb45c0882af7a2f5b6294fa2c29202ac529a6f1584e763a00c4812782f8274498a9c008ef0901dd67d895fd448e0eeb19a75cfe98bcd4c050c8856f97e5034

memory/1248-1048-0x0000000000D60000-0x00000000017F6000-memory.dmp

memory/596-1049-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1960-1058-0x0000000000FD0000-0x0000000001A66000-memory.dmp

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\unins000.exe

MD5 fa3f6d3bed7348ac3f45fde9e4ded1e4
SHA1 fdbf41b865e6a697142e8a2beb975ee728c41585
SHA256 3dbf88889ad9e347ac3fe93ec6f5d3771eff1fc2de39f8d7b3df9263a76b651e
SHA512 ed3d9fde7060b138b838ecc47969e601872b6a9541a39e24fbe7b56e1a68e414a93d9de187331d4dbf02430d4165c36ae2b167457e8ee90c59796ba7da972524

C:\Program Files (x86)\FileCenter\Drivers\InnoCA.dll

MD5 2fbf69d014ae135d473ec8243d44be9e
SHA1 2c28d3b23d8ff061ae554ccd92aec93900e3cb2b
SHA256 6f0d663f59487a01eebb128a9c4984789b91eaa764194ed9f0ed63583577d2d3
SHA512 530ab82b0ba1e148889bf41d6b00c67aee8ea4ff014b7e9d76bef682f8ce34a6908213b4d6f979ba02c6abe907cd1ac28bd323b4b766ede52b49ddd054d8b654

memory/596-1113-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2276-1112-0x0000000000400000-0x000000000052C000-memory.dmp

memory/2972-1115-0x0000000000400000-0x000000000071A000-memory.dmp

memory/2972-1117-0x0000000000400000-0x000000000071A000-memory.dmp

memory/2872-1118-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/600-1119-0x0000000001AB0000-0x00000000024E9000-memory.dmp

C:\ProgramData\FileCenter\Settings\HUBData_Lock.tmp

MD5 724deba0ee02aa7ad576295d784b1230
SHA1 f4f36556c9babc24a278f5f2ddcce4bff6a64bc7
SHA256 a98ebebe7123b54822d1250f6264dd8d971e47d5cc718fac967d2dd2374365ac
SHA512 3855cea9f71c3905baa510a42cf397da2b9f4f27cd071246e72911e646d6f5ba93fb120cb1a2f4d3e6a73d3d5ec40afc6dfbfb9e495e9bb9a2296930b1702239

C:\ProgramData\FileCenter\Config.ini

MD5 4a2b0b2d8d08db9fcc6eae2e25c9b4d1
SHA1 bcbd9242fe7ad0afabb143453d732657cfc79ede
SHA256 70bc9116d9db8cee6aaf87d19d323fc4961f90116b9a61281a981a461505974e
SHA512 5dc550410f15e4f64e637f61d8b6b09024b7502202ddd346463ac05b962d9bd6c3aecce6b85e089ca53184e99753cb2b137fae9ea26334d8044a0266742f6826

C:\ProgramData\FileCenter\MyPortal.ini

MD5 8af40c2a9db1af603163ed8b0e25a3d0
SHA1 36db1a9baec9e7d6d17073529afff9df063e68d9
SHA256 64b92b073e9519d07676100c694c63207f45b561ce66594b8728eae023ba0705
SHA512 2662a09e1cd148cbb4ee1124e4fdac6561699f447c986992651ff8fb8e7d005803b74ce5c1bb65c6f916ab1407894fabd453735c10378a94d5c918b1fe66688d

memory/3028-1222-0x0000000000FD0000-0x0000000001A66000-memory.dmp

memory/308-1224-0x0000000002540000-0x0000000002F79000-memory.dmp

C:\ProgramData\FileCenter\Intercepts.ini

MD5 293bfe23c32bd1332e4caf09e9bb347d
SHA1 1777f80e58dcc9b37cf87d73a4680723c7b87461
SHA256 3f6dd37419d2c2075812e0a104d0603d78a5cf1b378154e8d71c30c37de84264
SHA512 0ec00fc8b45d2fa205be404a37546772919f891d439e336dd601c0961355dd9afdbae983c254a9760207ea15b7b446b7b9d90ad93f7b938aeb74e838204be194

memory/600-1543-0x0000000001AB0000-0x00000000024E9000-memory.dmp

memory/600-1542-0x00000000002F0000-0x0000000001908000-memory.dmp

memory/2232-1553-0x0000000002540000-0x0000000002F79000-memory.dmp

memory/2232-1552-0x00000000010F0000-0x0000000002536000-memory.dmp

memory/600-1558-0x00000000714A0000-0x00000000714A1000-memory.dmp

memory/600-1556-0x00000000714A0000-0x00000000714A1000-memory.dmp

memory/600-1562-0x0000000071490000-0x0000000071495000-memory.dmp

memory/600-1561-0x0000000071480000-0x0000000071482000-memory.dmp

memory/600-1566-0x0000000071450000-0x0000000071455000-memory.dmp

memory/600-1565-0x0000000071460000-0x0000000071461000-memory.dmp

memory/600-1564-0x0000000071440000-0x0000000071442000-memory.dmp

memory/600-1563-0x0000000071460000-0x0000000071461000-memory.dmp

memory/600-1568-0x0000000071420000-0x0000000071425000-memory.dmp

memory/600-1567-0x0000000071410000-0x0000000071412000-memory.dmp

memory/1656-1570-0x0000000001070000-0x0000000001368000-memory.dmp

memory/308-1583-0x0000000002540000-0x0000000002F79000-memory.dmp

memory/308-1582-0x00000000010F0000-0x0000000002536000-memory.dmp

C:\ProgramData\FileCenter\ColumnStatesCab.ini

MD5 9481fa75e40fd7d6236b4680a546a110
SHA1 7c5260ab9d1c9dbf77f9a10708de8d484a7d731f
SHA256 115fc9747d7294635c8ca982169e3cf7fe25932ae2f1fa1ff8fb502ab9de3404
SHA512 7bae892db74ef424fe8cf7e98013a98a00313d00188f7919fb39ec9553a380a98159e289a4f153b204cf176a563a568a938678a1ad985b85d3c5fee06f4ebb91

C:\ProgramData\FileCenter\ColumnStatesCab.ini

MD5 71a194b9d4ceb795f7d5306e36f72420
SHA1 e36dcd697224dffe1993c3207f4a5d1786a66a21
SHA256 233191406a7259278487b59e59ed1efaf3310a5407c3b4f922bdb4493d2d39cd
SHA512 678f538a241cb88d70effb4fefc320788d1d0e55d196418e8bb24b2fbd6f5db12012d90d1455617edc36d672f51636987aeefd88dc441d9f755248f1d10e3319

C:\ProgramData\FileCenter\MRUIMGEditor.ini

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\ProgramData\FileCenter\ColumnStatesCab.ini

MD5 3c78191be09b4a0cbad92cfeb1218759
SHA1 26ac00f02d2e39cba573e908adab29332fdf2d74
SHA256 e089ca10bb421f8d22fcd5a547fa2f491235c009ee27e0b4542d692a16d2c232
SHA512 ee6f21932a0d63854d6cd1bc2c8abb60463060ceb62aecf1133f51a3b1198ae520d64363f819402060c768611b62b48f9eb9e1baeeefc4e653b257b086316443

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5209f2634a1532da7ec17bfc54e7981e
SHA1 637bdd8300be614331f494a867b2972385d8bdc0
SHA256 245b02ac50bd71dc79b1579327c01cb52ef485a18c5f835fd752335a9bf201a2
SHA512 74e6f09c20ab888927e99f53504e354255abea060a5adc72b45d010b153ebd6d17efcbb86d043d6ec6ac4d7bd30ffe91544ec4c6987fc180aec24ed0afaad90b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a3dc0a976c07ff4a2d067f454ba4c029
SHA1 b008f72e8d810d79de82ca6db9111bdb08e60f37
SHA256 8afadcc12b036da91c4f24174d8bed55bde19e2655f7c2f6a307ca1300e1b313
SHA512 fa0f3e3240e91f1848c6afef685b27aaca88229ae7788bcccae45d9eb173a5aefd892ef39a93cb0fbf86702ebb97cc5ed65d6fe45a0322953b5c5f55407cf629

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 01db72c5cb4a4c9d0f889cc9aff6ff8f
SHA1 b40913bce6c7383df200b5bee4b114368eaffe78
SHA256 9816b982e00af8f92be476cf46727c41e477f77cf8b668da9ef7513a9d10ee10
SHA512 8441b4d1681ad099ed2ddcdbd2f90100645d9c33131261fcf2b7ba58006d8db024380773e5325e02660355f238f72e8f520d7152397856dd850373697ef1c45a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 623a53604aa5f0704b6e263ba2572dc5
SHA1 3f6a8c52802b1d477403e0d44a65882cfd84ddd2
SHA256 e7c24711fe99a86205f996bc3c72ea8b531f3c876ff6a911cd16b1c31bf4a272
SHA512 1237ff3c79e8485956e197f1403f2e3976a68e38c3d481ea5699dd03b8a018c40cd5497223c72f9039b94837f22acc35827a6d5eb665aa861d8003599660ca92

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d848363de8f6d6a07cc0bc1dd0aa962d
SHA1 b8909034d27b751f74d7a133cd01ce5207e5af7d
SHA256 1c3d177d85a28089a98bf5770edd65b2883c53b5c5d055a167f2282e5e9257c7
SHA512 e9826eb1824d40177756a4e0247b2c503c9ea867f3793a888f844574695d8d9b16234cea2f3a9b841db62ec33cd4a5b22752820ebfa80d9890d7662553c855a9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4f81336e48c4fba9a1d0d7aa866a65c0
SHA1 22e70f13952e15ccb8704afee7b009fa86bca68c
SHA256 6b01095926287ca3b6c72ffc2e240b67f027c92d396d0210be9ade7a6334749f
SHA512 8780807f8c5b1d80299d97bc007cef44ab35c101cea4a1d5084e49b2d00f9c68a9fa11465ecf480337e25acf5fb408556715f4ee002b3041c378ef98ae0547ac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a24ef284931f6d2f7b53abda9465929
SHA1 5a8db3817cbe77c68828c7d525b0fcc83328479e
SHA256 9a4ee4af78a6d5c2cbd156451e53c86c2816b2b2cc7c509996a6f6b3acb05717
SHA512 4501058869836ebe9c85fe6b9b2e4d6c7fe97c292c8367d38e0e533c3d735e14c005a9e7fca6b18e56e8e651c7cf6c347322ad8715e801bab5e62769b8954aa9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4371ba9e2dcf29fd9e25f5d997ff9a73
SHA1 3663f34aa25218414ae4ab293df2c301d7dbfe84
SHA256 5eaefe4db3b10b1f650f1ab3b2db736b86a1f8266456f9941cd0b3bf8758832e
SHA512 2b1c0b5a603d5d0c8b12c7cb97a17bead4f4949350fceac502c7177e4b65eba35acd107581c9dcfb8f6d9a23d9dc4d2e29e79c76489b5be61aff0d9b133f2ba6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d89918ff90f05cee8180a9be4adc177c
SHA1 b4e7eb3f34533615fdfca70a5c7b3558acab3e42
SHA256 ac9566aeb2ddc70a393028bc370eaee662502b4bb81acafaa5038698c79fde0b
SHA512 7f1a9151b25530a4ee13b008b15d7de1985c30ed86ff8751ff312bfa3e3056f1a98127ef0ce72c0cb2d6d3830487e01a7b9bafec6135fbc96f4967ae1ad510f1

memory/600-2230-0x000000006F420000-0x000000006F5C2000-memory.dmp

memory/600-2228-0x00000000002F0000-0x0000000001908000-memory.dmp

memory/600-2229-0x0000000001AB0000-0x00000000024E9000-memory.dmp

memory/308-2339-0x00000000010F0000-0x0000000002536000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-21 15:11

Reported

2024-06-21 15:26

Platform

win10v2004-20240611-en

Max time kernel

172s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileCenterAgent = "C:\\Program Files (x86)\\FileCenter\\Main\\FileCenterAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileCenterAutomateAgent = "C:\\Program Files (x86)\\FileCenter\\Main\\FileCenterAutomateAgent.exe" C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{3780ab31-c524-4f3b-a4db-79d692700a62} = "\"C:\\ProgramData\\Package Cache\\{3780ab31-c524-4f3b-a4db-79d692700a62}\\PDFXLite10.exe\" /burn.runonce" C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Windows\System32\MsiExec.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\{BD1B01B0-89EF-47A3-82A5-AD94243ED846}\.cr\PDFXLite10.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\DRIVERS\x64\pxcdrv.xml C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File opened for modification C:\Windows\system32\spool\DRIVERS\x64\pxcdrvL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File created C:\Windows\system32\pxc50pm.dll C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File created C:\Windows\system32\pxcpmL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\pxcdrvL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
File opened for modification C:\Windows\system32\pxc50pm.dll C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\PXC50f.DLL C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File created C:\Windows\system32\spool\DRIVERS\x64\PXC50UIf.DLL C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
File opened for modification C:\Windows\system32\pxcpmL.dll C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrsjpeg2k15.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-DPUF8.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.zh-TW.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Drivers\is-REDBN.tmp C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterReceipts.exe C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterOCREngineRI.exe C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\DTKBarReader.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\Dlltwain.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-A285U.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\ISYSreadersocr.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Tips\is-3GOJF.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Samples\is-JO56U.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.da-DK.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.fr-FR.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-7D92Q.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-318UE.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\secman.dll.log C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrsjpeg15.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.pl-PL.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.pt-PT.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.de-DE.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-CFC2V.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-QOH5R.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-EGQSE.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-BVIL3.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-MLOFB.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.pt-BR.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\secman64.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrsbarcode15.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-DNVKB.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-QV1PG.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\EZT4Dcx.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\EZT4Ocr.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-383H0.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\Temp\x64\PXC50uif.dll C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
File created C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateAgent.exe C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\EZT4Pdf.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-NV01E.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\x86\pxcdrvL.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-2OPPB.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-GOINS.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\TrackerUpdate.lt-LT.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-T8P8D.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\DriverUI.he-IL.xcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\FileCenter\Main\is-R17AT.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-E4D2A.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-84QF1.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-T98JP.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-ERF69.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Uninstall\FileCenter\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files\Common Files\Tracker Software\Common\Languages\pdfSaver.tr-TR.xcl C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenterAgent64.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\clgsapi32w.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-OMPGS.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\GdOCR\is-067TQ.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\is-6T5PN.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\IRIS\is-H3D4B.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\Plugins.x86\is-35J24.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\FileCenter.exe C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File opened for modification C:\Program Files (x86)\FileCenter\Main\IRIS\idrsdocout15.dll C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
File created C:\Program Files (x86)\FileCenter\Main\fonts\is-1SEVS.tmp C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI9C5B.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9DF6.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{6318D993-1BE8-4BE4-B9E9-D6BFED11A071} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9F40.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5897d6.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{6318D993-1BE8-4BE4-B9E9-D6BFED11A071}\AppIco C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9BBE.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5897da.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{6318D993-1BE8-4BE4-B9E9-D6BFED11A071}\AppIco C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA443.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA4C1.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5897d6.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9EE1.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9DB6.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA319.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9C8B.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9D48.tmp C:\Windows\system32\msiexec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe N/A
N/A N/A C:\Windows\Temp\{F3B228E9-267B-451A-97F8-84626EF487CF}\.cr\vc_redist.x86.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe N/A
N/A N/A C:\Windows\Temp\{BD1B01B0-89EF-47A3-82A5-AD94243ED846}\.cr\PDFXLite10.exe N/A
N/A N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
N/A N/A C:\Windows\Temp\{F3B228E9-267B-451A-97F8-84626EF487CF}\.cr\vc_redist.x86.exe N/A
N/A N/A C:\Windows\Temp\{BD1B01B0-89EF-47A3-82A5-AD94243ED846}\.cr\PDFXLite10.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a1a8d825d9cc14480000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a1a8d8250000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a1a8d825000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da1a8d825000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a1a8d82500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
N/A N/A C:\Windows\SysWOW64\TASKKILL.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\Policy = "3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40} C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\AppName = "pdfSaver5.exe" C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\AppPath = "C:\\Program Files (x86)\\FileCenter\\Drivers\\PDF-XChange 5\\" C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABA61947-63DA-4A87-A926-786EB7A10B40}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\AppName = "C:\\Program Files\\Tracker Software\\PDF-XChange Lite\\pdfSaverL.exe" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F1C58E0-2797-4EB7-A74A-397B24BB769D}\AppPath = "C:\\Program Files\\Tracker Software\\PDF-XChange Lite\\" C:\Windows\system32\msiexec.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D6E145F8-828D-36C9-9FAD-24DAFD63BE9A}\TypeLib\ = "{B5893B58-701E-4110-9871-1DA14CF9C1DC}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AC305882-1ABA-3F2C-A65E-21C65724405D}\ = "_AnnotationComment" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6835517-900C-37F4-B861-936E79F91A48}\InprocServer32 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83328EEE-6A61-41A5-AC05-CBEEB93FB630} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F578A25-D034-35D4-86DE-F5B986E0AC71}\TypeLib C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8E2CC9E0-0E1D-3BB4-978C-49CB86E5389F}\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47E0ED94-1A20-3001-B99E-93B943446B6D} C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00A6C0B2-9F12-3145-BBA5-DC5D71A5963B}\ = "_ControlMouseWheelEventHandler" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E44BB2E-FE28-495A-9D65-B4845C676567}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{419BF6AA-AA35-3FBC-B01B-554F71547437}\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1737240B-9039-3E31-B522-2E6D9ED279E0}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3C2B51C-003A-4D39-A90A-BB4486BF1E2C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{68536869-DF6F-30E7-8388-90030E7F9FDF}\14.2.69.0\Class = "GdPicture14.PdfSignatureHash" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56169002-DDE6-3E69-B5A6-F822875A8F98} C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D8DD4B1-B719-303C-8F01-7C00B4A93B1F}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GdPicture14.GdPicturePDFReducer\CLSID C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{12A9C2C4-700D-3621-BF41-CA4109FB648A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04F02086-5AEB-39DB-AFBE-B01E669F37FB}\TypeLib\ = "{B5893B58-701E-4110-9871-1DA14CF9C1DC}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F7817FE-ED49-4111-A10D-B187262CF499}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51DE5D08-F43E-386D-AE8D-9A8EEF3C7B60}\InprocServer32\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1FB2340C-1E2A-3B9C-A78E-28C55F46EC7C}\14.2.69.0\Class = "GdPicture14.PdfDocumentMergingOptions" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A746F33A-F50D-383F-880C-8B2EF54A38D3}\14.2.69.0\Class = "GdPicture14.MICRContext" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8756C601-DB33-3E27-A201-89D054D1148A}\TypeLib C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7F6F77C6-6570-3583-B9E4-95C1551B0455}\TypeLib C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EF5FC277-ED69-3343-8AF7-B140C21CE2E2}\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64C637FA-F48B-34D1-A304-DC66BA9197C7}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC70B8EB-6829-3575-8A6C-F50F1F17132F} C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B49BC40E-9DA8-39EA-B326-2FED8F629A16}\14.2.69.0\Class = "GdPicture14.PdfAnnotationFlag" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C514BAF9-7532-33E9-9198-CDDC695B414B}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB35E2D7-12DB-4DD7-AE5E-43B6E2B9D163}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{999A6C12-A602-4601-9866-0B9AE973B7F2} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6F64923D-567C-4603-82D9-1AAABB307C20}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37E99E54-EBC0-3812-8B9C-9694F16FF3F3} C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B27E7FF-6279-49DA-AE6B-8E13AD665B1F}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{2666B658-5DDB-3409-9EDC-8B7A7AADFC26}\14.2.69.0\RuntimeVersion = "v4.0.30319" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96AAC88F-80CA-43E8-8576-8221FA5608B2}\ProxyStubClsid32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{206530FD-ED79-48C5-A590-4FC73CF3BD58}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBED514A-A877-398F-AE2A-A1EDE5F43724}\InprocServer32\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{732C85A4-B68F-4D3F-920A-B13DB0BDC9C8}\Implemented Categories C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C5CE95F-3FC4-4FE8-8159-21D550451AF8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78874680-AE90-4F97-8236-5016AFFE6569}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70026DA6-0CB8-4F47-8789-5DEF9F2BC4A1}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1A4B2A31-5192-353E-BD93-76DEE87DB99E}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D6A9405-9A84-362E-875E-2B6C1801C196}\TypeLib\ = "{B5893B58-701E-4110-9871-1DA14CF9C1DC}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AC50C196-9EF9-3BFB-8E62-BC5CE6779E4C}\TypeLib C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{DAAB4CCC-0DED-382B-B4B8-533519BED688}\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A527388D-E382-4227-BDAA-D8278C7B1924}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A8ACDBCC-219F-3158-9143-5ADD1D753CFE}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EB0BFF89-7F16-360E-A5B8-7D5E5BCF7CB3}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{47BD6E57-590F-325A-90B0-DA2B5F691A9B}\14.2.69.0\Assembly = "GdPicture.NET.14, Version=14.2.69.0, Culture=neutral, PublicKeyToken=f52a2e60ad468dbb" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A46B9230-3A18-3180-9BA9-1D063B9DB1B7} C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}\InprocServer32\ = "mscoree.dll" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E6A9E70-4B40-48C5-A77E-1E6489C96521}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CED0F57-B96A-4CF2-83B8-130E544A2644}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XCVault\DefaultIcon\ = "\"C:\\Program Files (x86)\\FileCenter\\Drivers\\Vault\\XCVault.exe\", 1" C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C8238AD-4C2C-480B-8945-747DACCD06EE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76F6C77B-0FFF-43F5-8DE3-0715163D80DD} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C0F85EB-00C8-33F4-8407-D77C223841B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{50B4C2D7-BD1F-3AA0-B81F-8C1054BC813E}\14.2.69.0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEF95872-5108-3B21-945F-2AC999C690F9}\TypeLib\ = "{B5893B58-701E-4110-9871-1DA14CF9C1DC}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D1BB55E4-30AD-3EE8-A1F7-58A9B4A6F59D}\TypeLib\Version = "e.2" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4632AD28-FA8B-3BAA-BA67-C9C604AB0F9D}\14.2.69.0\CodeBase = "file:///C:/Program Files (x86)/FileCenter/Main/GdPicture.NET.14.DLL" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GdPicture14.GdPicturePDF\CLSID\ = "{A3AB685D-A017-34B0-B2B6-08EE7121AF3C}" C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B2149EA7-B58E-378B-8E52-70645A0BEC94}\TypeLib C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Windows\System32\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenter.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A
N/A N/A C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3704 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp
PID 3704 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp
PID 3704 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp
PID 3480 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 3480 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 3480 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 3480 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 3480 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 3480 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 3480 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 3480 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 3480 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 1540 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1540 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3480 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 3480 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 3480 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe
PID 3608 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3608 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3480 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe
PID 3480 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe
PID 3480 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe
PID 4372 wrote to memory of 4760 N/A C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 4372 wrote to memory of 4760 N/A C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 4372 wrote to memory of 4760 N/A C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 4960 wrote to memory of 1532 N/A C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe C:\Windows\Temp\{F3B228E9-267B-451A-97F8-84626EF487CF}\.cr\vc_redist.x86.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe

"C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp

"C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp" /SL5="$B004E,314098152,831488,C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"

C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe" -S -INFO "-1" "3" "11" "C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtilsInfo.ini"

C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe" -S -INFO "-1" "3" "11" "C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtilsInfo.ini"

C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe" -CLOSEALL

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterPortal.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReceipts.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReports.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileAgent.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe

"C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe" -INSTBEG

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterPortal.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReceipts.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterReports.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileAgent.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -INSTEND

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\PDFXEditCore.x86.dll"

C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe

"C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe" /silent

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\dten600.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\lbvProt.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\VSTwain.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\secman.dll"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.dll"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" /s "C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll" /codebase /tlb

C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe

"C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe" /install /quiet /norestart

C:\Windows\Temp\{F3B228E9-267B-451A-97F8-84626EF487CF}\.cr\vc_redist.x86.exe

"C:\Windows\Temp\{F3B228E9-267B-451A-97F8-84626EF487CF}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe" -burn.filehandle.attached=656 -burn.filehandle.self=684 /install /quiet /norestart

C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe" /install /silent

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -PRINTER

C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe" /quiet /norestart /log "C:\ProgramData\FileCenter\PDFPrinterLog.txt" PNAME="FileCenter PDF Printer" ORGANIZATION="FileCenter"

C:\Windows\Temp\{BD1B01B0-89EF-47A3-82A5-AD94243ED846}\.cr\PDFXLite10.exe

"C:\Windows\Temp\{BD1B01B0-89EF-47A3-82A5-AD94243ED846}\.cr\PDFXLite10.exe" -burn.clean.room="C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe" -burn.filehandle.attached=544 -burn.filehandle.self=556 /quiet /norestart /log "C:\ProgramData\FileCenter\PDFPrinterLog.txt" PNAME="FileCenter PDF Printer" ORGANIZATION="FileCenter"

C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe

"C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.be\PDFXLite10.exe" -q -burn.elevated BurnPipe.{3089B57C-9094-44BA-BA10-3614CF53ECA8} {4BB312B7-88F9-4A14-B253-802C48B2D910} 4464

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" /s "C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll" /codebase /tlb:GdPicture.NET.14.64.tlb

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 3A006377990EC9937D1C961010FD2B2F

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding F232A69EE1107F9D300AD5D8C5758EDD E Global\MSI0000

C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\PrnInstaller.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\Drivers\\PrnInstaller.exe" /L /I_D_R_M_P /F /N "FileCenter PDF Printer"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "FileCenter PDF Printer"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "PDF-XChange Lite"

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -DRIVER

C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe" /VERYSILENT /NORESTART /NOICONS /COMPONENTS="pdfSaver,PDFXChangedriver" /DIR="C:\Program Files (x86)\FileCenter\Drivers\" /PName="XChange Internal Driver" "/Organization:FileCenter" /LOG="C:\ProgramData\FileCenter\PDFDriverLog.txt"

C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp

"C:\Users\Admin\AppData\Local\Temp\is-HQGH8.tmp\PDFX5SA_sm.tmp" /SL5="$40306,5384545,119296,C:\Program Files (x86)\FileCenter\Drivers\PDFX5SA_sm.exe" /VERYSILENT /NORESTART /NOICONS /COMPONENTS="pdfSaver,PDFXChangedriver" /DIR="C:\Program Files (x86)\FileCenter\Drivers\" /PName="XChange Internal Driver" "/Organization:FileCenter" /LOG="C:\ProgramData\FileCenter\PDFDriverLog.txt"

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\prninstaller.exe" /W0 /I /N:"XChange Internal Driver" /Base:"PDF-XChange "

C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe

"C:\Program Files (x86)\FileCenter\Drivers\PDF-XChange 5\pdfSaver5.exe" /RegServer

C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe

"C:\Program Files (x86)\FileCenter\Drivers\Vault\XCVault.exe" /install

C:\Program Files (x86)\FileCenter\Main\FileCenter.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenter.exe"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "FileCenter PDF Printer"

C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe

"C:\Program Files\Tracker Software\PDF-XChange Lite\pdfSaverL.exe" /SetOptions "Save.RunApp=false" /Printer "PDF-XChange Lite"

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterUtils.exe" -OLOFF

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterAgent.exe

C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.filecenter.com/action.php?Action=Welcome&Refresh=1&ProductKey=&KeyID=-1&PTID=1&SourceID=-1&CustomID=-1&VerID=-1&PartnerID=0&WelcomeID=0&Version=12.0.16.0&CN=TMUACBLB&UN=Admin&Trial=0&DaysLeft=0&s=&cnt1=&cnt2=&cnt3=&cnt4=&cnt5=&cnt6=&cnt7=&cnt8=&cnt9=&x=1235

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe741c46f8,0x7ffe741c4708,0x7ffe741c4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6120458283947926172,18309813826532575096,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,6120458283947926172,18309813826532575096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,6120458283947926172,18309813826532575096,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6120458283947926172,18309813826532575096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6120458283947926172,18309813826532575096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6120458283947926172,18309813826532575096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,6120458283947926172,18309813826532575096,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5280 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x304 0x2f4

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6120458283947926172,18309813826532575096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6120458283947926172,18309813826532575096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8

C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe

"C:\Program Files (x86)\FileCenter\Main\FileCenterAgent.exe"

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterThumbs.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /T /IM FileCenterScanner.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 133.194.101.151.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 www.filecenter.com udp
US 98.129.229.7:80 www.filecenter.com tcp
US 98.129.229.7:80 www.filecenter.com tcp
US 98.129.229.7:80 www.filecenter.com tcp
US 98.129.229.7:443 www.filecenter.com tcp
US 8.8.8.8:53 7.229.129.98.in-addr.arpa udp
US 8.8.8.8:53 assets.filecenter.com udp
US 8.8.8.8:53 calendly.com udp
US 8.8.8.8:53 assets.calendly.com udp
US 8.8.8.8:53 code.jquery.com udp
US 98.129.229.7:443 assets.filecenter.com tcp
US 98.129.229.7:443 assets.filecenter.com tcp
US 98.129.229.7:443 assets.filecenter.com tcp
US 98.129.229.7:443 assets.filecenter.com tcp
US 98.129.229.7:443 assets.filecenter.com tcp
US 98.129.229.7:443 assets.filecenter.com tcp
US 8.8.8.8:53 static.zdassets.com udp
US 104.18.41.175:443 assets.calendly.com tcp
US 151.101.130.137:443 code.jquery.com tcp
US 172.64.146.81:443 assets.calendly.com tcp
US 104.18.70.113:443 static.zdassets.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.63.101.171:80 apps.identrust.com tcp
NL 23.63.101.171:80 apps.identrust.com tcp
NL 23.63.101.171:80 apps.identrust.com tcp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 bat.bing.com udp
US 8.8.8.8:53 static.hotjar.com udp
US 204.79.197.237:443 bat.bing.com tcp
GB 13.224.245.61:443 static.hotjar.com tcp
GB 163.70.147.23:443 connect.facebook.net tcp
US 8.8.8.8:53 104.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 137.130.101.151.in-addr.arpa udp
US 8.8.8.8:53 175.41.18.104.in-addr.arpa udp
US 8.8.8.8:53 81.146.64.172.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 113.70.18.104.in-addr.arpa udp
US 8.8.8.8:53 171.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
GB 142.250.200.3:443 www.google.co.uk tcp
US 216.239.34.36:443 region1.analytics.google.com tcp
BE 64.233.166.156:443 stats.g.doubleclick.net tcp
US 8.8.8.8:53 ekr.zdassets.com udp
BE 64.233.166.156:443 stats.g.doubleclick.net tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 script.hotjar.com udp
US 104.18.70.113:443 ekr.zdassets.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 18.245.253.99:443 script.hotjar.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.200.3:443 www.google.co.uk udp
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.147.35:443 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com tcp
US 8.8.8.8:53 info.filecenter.com udp
US 3.92.120.28:443 info.filecenter.com tcp
US 8.8.8.8:53 lucion.zendesk.com udp
US 104.16.51.111:443 lucion.zendesk.com tcp
US 8.8.8.8:53 widget-mediator.zopim.com udp
IE 52.31.6.7:443 widget-mediator.zopim.com tcp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 61.245.224.13.in-addr.arpa udp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 61.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 2.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 8.8.8.8:53 156.166.233.64.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 99.253.245.18.in-addr.arpa udp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 28.120.92.3.in-addr.arpa udp
US 8.8.8.8:53 111.51.16.104.in-addr.arpa udp
US 8.8.8.8:53 7.6.31.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 216.239.34.36:443 region1.analytics.google.com udp

Files

memory/3704-2-0x0000000000401000-0x00000000004B7000-memory.dmp

memory/3704-0-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-RS5VH.tmp\FileCenterSetup12.0.16.0.tmp

MD5 0acf3c16e6faca9c0aec525f53d03866
SHA1 5c3960b48d2b72ad02e59470d8a7b690ee826f9e
SHA256 2c470730bf3efa3f4a9dc184548abefbab8c4aecc43e14834c5810159019c151
SHA512 17d98a3b52eb89e02a371f1d6effa59f624696cd14b0589fe436640ddbe04fc6c5d82834f73699dbaa32a7a69343f82863820e72e225e17d710c4de5102b46c2

memory/3480-6-0x0000000000400000-0x000000000071A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-MEEF7.tmp\FileCenterUtils.exe

MD5 e9638374a27160513f1a62827b6cf102
SHA1 b9da58896020d46c4ef16f8f1b332d5f6c1e6f0f
SHA256 c064ba394872e6a8277a5c71b50da34b800d682e403c6b80ec3ba37badf38942
SHA512 9632c8416f542dc96f22a0ddcd109e85c29368b1263d86f74bab39aae8e9271a7b3e2eea18932cf4e3fb5e269d3892016b878d29fb6dad002db11367849f293c

memory/1724-12-0x0000000001680000-0x0000000001681000-memory.dmp

memory/1724-13-0x00000000005E0000-0x0000000001076000-memory.dmp

memory/3704-14-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/3480-15-0x0000000000400000-0x000000000071A000-memory.dmp

memory/540-18-0x00000000005E0000-0x0000000001076000-memory.dmp

memory/3480-19-0x0000000000400000-0x000000000071A000-memory.dmp

memory/3480-20-0x0000000000400000-0x000000000071A000-memory.dmp

memory/1540-22-0x00000000005E0000-0x0000000001076000-memory.dmp

memory/3608-24-0x00000000005E0000-0x0000000001076000-memory.dmp

memory/3480-35-0x0000000000400000-0x000000000071A000-memory.dmp

memory/3480-185-0x0000000000400000-0x000000000071A000-memory.dmp

memory/3480-467-0x0000000000400000-0x000000000071A000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\FileCenter.exe

MD5 879d5b401a73cc57a3166ba01ce70c60
SHA1 ee8b47af48514a3b65f4ee838c95e7a3a64d3434
SHA256 82da544c9d730c17c34a253c29fd7d621e8cdc064e0220c27e43bb0dd60c4ebe
SHA512 6e49343acca8ab878b4cf9e12ce4d796decd7f44c7068f8d90f5ad2eebbab31c15c82bbf66bcb571120a9bf8e375055558308d00b66053591c6ec94fb514b3b6

C:\Program Files (x86)\FileCenter\Main\GdPictureComReg.exe

MD5 b9718823c993fccb6352cc0210993569
SHA1 4d551f7cafd0040ff9657ca644c1365f3e7847ae
SHA256 a173ba320929c93b9bf41186a0692d753da812b8691dcc416c16abdf004dbf89
SHA512 6e513ef7535539cff90e88b95c5f57bb9e262cebbf1e51bc8268595347fbf06f628cf16eaa974d7eccd2a285ff2f8f56867c4292c1fe4fb7b0ee90f5acee9747

C:\Program Files (x86)\FileCenter\Main\dten600.dll

MD5 22cf875a0cf0ad89f5f7d7ac6628a598
SHA1 c2a9620579a08d6a91557e6cb8f1d2585392d30d
SHA256 11ef1b8791cfd8fee0923ec685ae1d29485349ce7d2d37a15ae1615e8d646baf
SHA512 3b59898730a9eb4a8f4347b8c854983636b28f6641b072fdd0d7f9190b905fc9b03dcf204154072048dc1a6a24785d2aead865b5bf160c9af9df87cf4175c608

C:\Program Files (x86)\FileCenter\Main\lbvProt.dll

MD5 120387e48d0556538ef3ee68de18a707
SHA1 0633de57f7ef851115be39d407db8e08986b3d93
SHA256 e202172ad8799ee0feee2559ac06f2cf75530f702f7e11d0cb4c1b3ec57eae4e
SHA512 a7509c2822bd7f08b5e67dfbd3d9ac701639599b5681966f5276f51e60608dcd7dafaa953f7589d99de7ba7b68eaa56be0ecb2c074f5c4ba6ba114880507b1da

C:\Program Files (x86)\FileCenter\Main\VSTwain.dll

MD5 13f5f7e228ce2b8a3a41dbad4e451279
SHA1 1b3837572602b2620b75bf2ad2aeab89a64f5287
SHA256 11b50ff0bc4e72cd2dd47fb8070a86781682b92a9fb1010a5fae97276afb2292
SHA512 24ea8072abb5c0d4083989539f399ad076cc92260aaf0317320dddb4196e752e1c082d386c75049a343b1c62765d587f2b66374b53e7b24326ee6129a7aa856d

memory/3768-558-0x0000000010000000-0x00000000101C8000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.dll

MD5 2b9bbd88d6b6a3b7c417cbb0eae69bf4
SHA1 c43ab9fa5c1085ba21280d143f8b8322d6a93883
SHA256 1e5f8dbd4c08faf3a0a84b6af17454d9d21459618b411696b9604af80ee9fc0f
SHA512 f07ae3e76066960a3b657146b83da724ca13873edd82d7314d048593c3e6021ced3297459d46a30daf95189631bfd4c941e44d91433549dcc70efb5407543a30

memory/4372-564-0x0000000000A50000-0x0000000000A58000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\secman.dll

MD5 085d87f49daf13496e0e018c4008fae6
SHA1 4b0c3058b8ace7e8242c941b449daa968f5b45c7
SHA256 d1f1e3717a68166942d1f7a71b78e35e3381edbb07d7d37ae8b603dcc3ffad15
SHA512 52886de13e538e0eef364a16da1ccd24a571450d417ead4ddb689efe8e8099f9964c5f6076a239e833bd41c88f2f95f30c20d722f880837aa541be366407145b

C:\Program Files (x86)\FileCenter\Main\FileCenterAddin.ini

MD5 70da425f8aac14b1484047edb83e60e8
SHA1 69d09199af5a5ba4ed4e1d59432fec784d5271e4
SHA256 258d4ad31457b1c117b248b6ba0dd1c44ba6ad0a0839623ced45ce15ebbd0a7f
SHA512 a9cf352b79a8f38f03a781bf55a94e2c1344e1de55e9ea21e736ad436d7452f8349a64fec3b46e7ddc1d11f5fa3ecc80329b5b4e1da702680e9c2223e57943d2

memory/4760-567-0x0000000000630000-0x0000000000642000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.dll

MD5 d9806fd0eeafd9f89e0473ad52889283
SHA1 d6fca558897aaa6703129557e2d02b1a84765dcb
SHA256 aa2aafe588aecd1a10bf05dcd675143061a55bcd5bc83bd749bde7b85d21dbc6
SHA512 796c609dc6fa4c6fe1e6909ae3a4a22cc06c900f34b999d77a9805767f69f1b1d96a99e9ee03ad6ab68e7f6bb5fa3269c1d73db4af68a2834bfd5cbf2fe91422

C:\Program Files (x86)\FileCenter\Main\vc_redist.x86.exe

MD5 35b40b21383ac38487ceec8ab6e53565
SHA1 59894bd9c96361b475c3b4b7ca9719c72e813d04
SHA256 caa38fd474164a38ab47ac1755c8ccca5ccfacfa9a874f62609e6439924e87ec
SHA512 3a00b40ba8cd1cf8a523efab656f5b8910a3b07f9d8fba4ffc07745165b6375affd77b00fd3064fa72fb984c1773438a39e67a55363be23dd8fe1727c1016b8e

C:\Windows\Temp\{F3B228E9-267B-451A-97F8-84626EF487CF}\.cr\vc_redist.x86.exe

MD5 86123c033231dd7e427d619ddeefd26a
SHA1 608c085348fd9c4e124e6f28f0388ccdac6ab2b5
SHA256 d863fb2f65bb6eea492e79ab9d09a53cc226e85f57d6545cb82f60b122a4b737
SHA512 ffb574123b350d3c9434abc88baa050ae6e54b5b9ebf3f1dcf4bf079284135696004508653e74a3a3c2fa8e4c1b681c3f31d5fe69e0f0c5f45ed37f9ddc61e78

C:\Program Files (x86)\FileCenter\Main\FileCenterAutomateService.exe

MD5 42d9ffbb0b7ef3cbdeb0c005619b12fb
SHA1 fbaed95c25aa26c43121e8421b5154e9e5dcdca0
SHA256 59e5b75c18c82acf2d94a1fd9b0a67af6795d594e1f837df1a80eec66671d307
SHA512 c77b91ca41b13bb471ced5346f998805430a33e210c09c0d7e0b0a7573d9e95da1bc5e351df08c871e1c3e962b3ec4b9fdb5ef5cc806fd87ef42f50ddd99d7cb

C:\Windows\Temp\{ACD0BFA9-5CC3-47C2-AB6E-2A9470ADFED8}\.ba\wixstdba.dll

MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

C:\Windows\Temp\{ACD0BFA9-5CC3-47C2-AB6E-2A9470ADFED8}\.ba\logo.png

MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

memory/4760-575-0x0000000007620000-0x0000000009B0A000-memory.dmp

memory/3408-659-0x0000000000210000-0x00000000009CB000-memory.dmp

memory/4236-660-0x0000000000250000-0x0000000000CE6000-memory.dmp

memory/4760-661-0x00000000058D0000-0x0000000005E74000-memory.dmp

memory/4760-664-0x0000000005420000-0x00000000054B2000-memory.dmp

C:\ProgramData\FileCenter\Config.ini

MD5 b2ad8f8dcc45644ea167317d050faac4
SHA1 215091d6ad9d4f210b85e675b17c60a7300ca9b1
SHA256 9aaebe4ab06e9de08e28b9b4da9248442c502ef5411d7d734c13af1afa2c2dd0
SHA512 528737e85d799e0312c335bbbb856f12ee885465e9b999d6cfb1b64d8c003744a5a6d6cd7ae2b6e41b9cbe23115990acd65debfcdd15e1677c955944403da6f4

C:\Program Files (x86)\FileCenter\Drivers\PDFXLite10.exe

MD5 4c61ee01d5b84db67c38c10d3f210f39
SHA1 844eab66505dc4eb88dec70c3f20307365c350ac
SHA256 a7e10bda5cb2e1c347b2ee682385fd56ff5da05c659c665abc0b526f639a5583
SHA512 a44a2bd871c9f0f654b0e627accc9d4388390e5e5b7326a3372a103886d74b89ab78e235e1b986da9acf0f08fdf45b642ec26000bbe32de92a44b1978f4c2f80

memory/4760-668-0x0000000005EF0000-0x0000000005EF8000-memory.dmp

C:\Windows\Temp\{BD1B01B0-89EF-47A3-82A5-AD94243ED846}\.cr\PDFXLite10.exe

MD5 63ed90cdd501829a2319f8cf86c52bd2
SHA1 da198bec49015e98baa5b2cb91903f659e31dd37
SHA256 529bcd90e571d51a19396cb457bf7eebecf494613030389fa7c5b25b8e42757f
SHA512 d8cc05a5d481e17432125d21d58c2b32696c8b3e6632f911184292a0f0b24910e9dc5cc3ae2bdc6d87e478aef81504aa34520d3bd6813517e4b9347eee0eaa19

C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.ba\wixstdba.dll

MD5 0ba387d66175c20452de372f8dbb79fe
SHA1 5411d41a7d88291b97fb9573eb6448c72e773b70
SHA256 7b3d4a22a56cd80f19c48a321f978f728d34b8227cdc7fcadeb76b7506b2bb33
SHA512 13ec6e6ddc602e8053aadd4dd84ed87c23b581f2a41d738e32a522128ca4985dcfcaedc7fab192085f0eb4facd1cd7ad91ccaf8505491e29288d2f66cbf705fd

C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\.ba\logo.png

MD5 04967ef5107480ea36b3e2e97af7eb7a
SHA1 6efdd4484dcfcfd45b3c887c852f0abb1a02a645
SHA256 63f2616963b68ac13dab898c1b5938ab1b353a9ba0f73c6a2f2c3c5c9eac0b21
SHA512 00ae4cff10b1a6e504d590d49bc4af707ad33c1739ed46f648dc348645bd5d4b61bf0c84448c78d7542fb6d7294f3aa753b4106579f15b1d726bf1118594c581

memory/4760-690-0x00000000064E0000-0x0000000006502000-memory.dmp

C:\Program Files (x86)\FileCenter\Main\GdPicture.NET.14.tlb

MD5 235af799cc5b5f0a846387765b004455
SHA1 7f766bc88ddca173a9118c2af7e8c04d03e9ffed
SHA256 bf1342653bad546aeda012fff620fa8455145fefd81eb9d1d9bb5d0c970d5864
SHA512 586192941caf51fcda886f859bbea0c02d0659857bf36d0a011a6207e5fd4d0cf877f8098003d66438e01d1684aef542dd96dcad637a698827e966b1103ec1b7

memory/5004-705-0x000002424DA30000-0x000002424DA40000-memory.dmp

memory/5004-706-0x000002426A590000-0x000002426CA7A000-memory.dmp

memory/3480-708-0x0000000000400000-0x000000000071A000-memory.dmp

memory/5004-709-0x000002424F7A0000-0x000002424F7A8000-memory.dmp

memory/5004-710-0x000002424F810000-0x000002424F832000-memory.dmp

memory/3364-716-0x0000000000250000-0x0000000000CE6000-memory.dmp

C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\PkgLite64

MD5 e91e50fc80f7d84561db5823595e5b63
SHA1 b3e40b17a668586e86f346e9a7e3b8ef4838d437
SHA256 3203656dcafaf1ae128dae78bab26829bf0c2c9e1c255a8ca15ed176651d8948
SHA512 c9bb45c0882af7a2f5b6294fa2c29202ac529a6f1584e763a00c4812782f8274498a9c008ef0901dd67d895fd448e0eeb19a75cfe98bcd4c050c8856f97e5034

C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\cab20F2A2993791BDD97B003B5578C7EAC7

MD5 951b5426340de231c90e0be2780cc66e
SHA1 fd6b966fd3270e53d8b1d660d69d4290b75b8a9d
SHA256 afac74f4b16fbefff34daec002a027abab8d45b6113ce1fde320cbf2b8eec68d
SHA512 038c0a171079502899366abf1101b173468a1a1997dafe94b6d217e26d5f6fec97e0d38fd4f7a70ef3d410dfdd18b7d93b3954776db3fc7ed9e91211492e0fb2

C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\cab5DD1590118F3640F385DB3EB2F516E5C

MD5 b8b961c9899ec926b1dd8258b0232626
SHA1 8ed4a38e4a7c856a427a068ec51539f2e630f86c
SHA256 e9c26ae1625eb454e4cd78dd9ac145eeae94190f943b6fc72d250dc3acb703d7
SHA512 5dbcdbaf86bb25029838b93fa5787d9833b3ac2e6861b3df405b7957f1e5355395bcc664f4a550d9d79a7d3f7d98ca740527d5a86ecd0bfe0df3e768016f1877

C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\cab293E212B151FCAC5768C99D66AA8D9AE

MD5 f7bd3fbb5859bd43e830b621c8ade037
SHA1 71838fa41b8906bdcb9a64eec599dafd25d92c6f
SHA256 789ca746d45588380841494901a531abcf7a9a184f74af2cf049a77f489f4dc7
SHA512 53dbfde654e6bdaaab257fc3968a50ee7b8e4641bdc739c55ce1697e869ac513a7f2dc72ab92074b062928d56ab6f8083c5fa8a71a16a2f6918cc52f73b81250

C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\cab8D36E281ACA51D7FBE9AB973BE9B36E3

MD5 0102ec8e3aa2b964f2d7719dd00de809
SHA1 9a008c6acc5c70c8467621bf4a8e78930e2843a3
SHA256 765cdd18ca4b9c8de8f16035ab46f740a9da9e628f24dbfe16800af41fa3122b
SHA512 ee4f280449bcceb357290c1970914524fcb30931b240591cee3f540fbfe365a81f5d6201eee9e18598163f9be392062ee8cfcdf16d289c4bc2effa6061e69c94

C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\cab20036D21E40418DD3280D692958B9275

MD5 bed8b8bddf71f7b921c8efac0eb69518
SHA1 df2818992742ed4e80d28a94e1b0f43f280db455
SHA256 3cbfff994fa8a50b2d89e0dc906eefaf50ea16b07acb8ed4478fb2b116fcb8a5
SHA512 5699485985ea856d8ef3e97372e51c98eb81225c18ab5a851e1d8f574c0c9e77986563ad63e9b2118bd42edac0a39a46727306484be71af485955f9e818502d7

C:\Windows\Temp\{A390CA37-52AE-4FC3-A889-971A673D3792}\cab66549ACD4EE6139A64068CA8626575A9

MD5 bf193f70c4ba12e12a592df1cdb17b40
SHA1 e84a6d1cbcdc79926f7defef1ad4b7a8a651b5cb
SHA256 cee91939598abb3ec23ce0dc93c7690421efdca54795997558ef0fc617442a82
SHA512 23077213cb84b84096c93da33f3a23bda28bcda638ec3a9256f4ab064d8bf6f1e2860d32e6713716f35803db92fb30c4f07b0b2accccd914d7bcb75910b63d79

C:\ProgramData\FileCenter\PDFPrinterLog_000_PkgLite64.txt

MD5 38c429561d5cf71f788735fc7d5ce1ee
SHA1 1d2101ab10694fa4fe89386e62315d66fcaa19ce
SHA256 957588b4273c972016fe6a5c513b0697b5964b4f6acfabd43481a8d5211ccd6d
SHA512 dcaca6eda0d2c44d0ad68c4bc0da0a47e998ea889379c839af4c38c36495f8111f81ff8e4c7114e826d73a584b84d3101845d1a06534b00a5b598d7c06f3bf3d

C:\Windows\Installer\MSI9BBE.tmp

MD5 5a36339a5bae618a2ef09d0adab0b602
SHA1 437d251abdcfe4f9379c44336ff5b920df7a0fbf
SHA256 2e1d52eec9169247f75b584f874617ea4702cf2fdf92a4306d84c354a0151674
SHA512 cff119e5b719c8578d199b946fc213074d89195d63bf6cf00dc2c255cc66695d0062da2e916a22d4df4c1bb1e195f69df21c463d144ad9442defe7b3033ead2a

C:\Users\Admin\AppData\Local\Temp\prnInstaller.log

MD5 bed1074f151db8ebac73db1f088d6012
SHA1 91f6e5453944cc0f444cea69b12ec34d1b2e0ba1
SHA256 a853a8d34d77d31b28306a81ceb7a13e82657f658e18d0237896c51bc48070eb
SHA512 1393dd190f0d3f7c66b8ea2e1ddd37f273d5896e435ccd40cf9dcc8f26e9e8d872a359eb86b118632fd023c9446d3a45be3911d1a9bd94cc6bf84c0117f61af8

C:\Config.Msi\e5897d9.rbs

MD5 bfab6019b14f541b0e31c1d43e5dfb92
SHA1 1d12773c2393b6fe12c4fbb3427465d02220a542
SHA256 6c8724445ab56d87dac4c2fc2dc1ba75ba668d80fcb17cd9ef95c82872d66ced
SHA512 8fb569ba6b2769bb891720d49cf31014cae4514b7dd8ca6ed53f9712b1078b8ea28ae8f69295a96d56c8c8b7a62279ac80c0ce3c95d9a33a7c22ca1d9c2ddae9

memory/3364-965-0x0000000000250000-0x0000000000CE6000-memory.dmp

memory/364-966-0x0000000000400000-0x0000000000428000-memory.dmp

memory/4016-969-0x0000000000250000-0x0000000000CE6000-memory.dmp

C:\Program Files (x86)\FileCenter\Drivers\InnoCA.dll

MD5 2fbf69d014ae135d473ec8243d44be9e
SHA1 2c28d3b23d8ff061ae554ccd92aec93900e3cb2b
SHA256 6f0d663f59487a01eebb128a9c4984789b91eaa764194ed9f0ed63583577d2d3
SHA512 530ab82b0ba1e148889bf41d6b00c67aee8ea4ff014b7e9d76bef682f8ce34a6908213b4d6f979ba02c6abe907cd1ac28bd323b4b766ede52b49ddd054d8b654

memory/2196-1026-0x0000000000400000-0x000000000052C000-memory.dmp

memory/364-1027-0x0000000000400000-0x0000000000428000-memory.dmp

memory/3480-1031-0x0000000000400000-0x000000000071A000-memory.dmp

memory/3704-1032-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/860-1033-0x0000000002BF0000-0x0000000003629000-memory.dmp

C:\ProgramData\FileCenter\Settings\HUBData_Lock.tmp

MD5 724deba0ee02aa7ad576295d784b1230
SHA1 f4f36556c9babc24a278f5f2ddcce4bff6a64bc7
SHA256 a98ebebe7123b54822d1250f6264dd8d971e47d5cc718fac967d2dd2374365ac
SHA512 3855cea9f71c3905baa510a42cf397da2b9f4f27cd071246e72911e646d6f5ba93fb120cb1a2f4d3e6a73d3d5ec40afc6dfbfb9e495e9bb9a2296930b1702239

C:\ProgramData\FileCenter\Config.ini

MD5 4a2b0b2d8d08db9fcc6eae2e25c9b4d1
SHA1 bcbd9242fe7ad0afabb143453d732657cfc79ede
SHA256 70bc9116d9db8cee6aaf87d19d323fc4961f90116b9a61281a981a461505974e
SHA512 5dc550410f15e4f64e637f61d8b6b09024b7502202ddd346463ac05b962d9bd6c3aecce6b85e089ca53184e99753cb2b137fae9ea26334d8044a0266742f6826

C:\ProgramData\FileCenter\MyPortal.ini

MD5 8af40c2a9db1af603163ed8b0e25a3d0
SHA1 36db1a9baec9e7d6d17073529afff9df063e68d9
SHA256 64b92b073e9519d07676100c694c63207f45b561ce66594b8728eae023ba0705
SHA512 2662a09e1cd148cbb4ee1124e4fdac6561699f447c986992651ff8fb8e7d005803b74ce5c1bb65c6f916ab1407894fabd453735c10378a94d5c918b1fe66688d

memory/1396-1133-0x0000000000250000-0x0000000000CE6000-memory.dmp

memory/4988-1134-0x00000000024C0000-0x0000000002EF9000-memory.dmp

memory/860-1136-0x0000000002BF0000-0x0000000003629000-memory.dmp

memory/860-1135-0x0000000000F10000-0x0000000002528000-memory.dmp

memory/4988-1161-0x00000000024C0000-0x0000000002EF9000-memory.dmp

memory/4988-1160-0x00000000008B0000-0x0000000001CF6000-memory.dmp

memory/860-1162-0x0000000000F10000-0x0000000002528000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 48909d08ddb7abda626dad53743a4f0b
SHA1 a863128a39deda904d5fd6cda2384ddd36021121
SHA256 6bb87d5a34250d348cb9675a689753af062faed550b107d671d6fbb867d61384
SHA512 7852ae4beb32ab0f225a8e9c0ffc9128ebb53fad3008a686c37744161e571da192bf302b95dcf374b92fd0361dad86abd1417bbe26e903d7a5b19eac64ec880f

C:\ProgramData\FileCenter\Intercepts.ini

MD5 293bfe23c32bd1332e4caf09e9bb347d
SHA1 1777f80e58dcc9b37cf87d73a4680723c7b87461
SHA256 3f6dd37419d2c2075812e0a104d0603d78a5cf1b378154e8d71c30c37de84264
SHA512 0ec00fc8b45d2fa205be404a37546772919f891d439e336dd601c0961355dd9afdbae983c254a9760207ea15b7b446b7b9d90ad93f7b938aeb74e838204be194

memory/860-1265-0x0000000000F10000-0x0000000002528000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 afbb37b49782b3b53f074dd18e8d33a2
SHA1 cdb58bbcecc6b065a7be9c908097c39701e8cee0
SHA256 1f2933cf0113e00bb981627030364b8888daafca639fcb43affd046ef2c74f00
SHA512 d4c0f114cdbc969832c6d3f4d6d354a48080eb1878ecae5f34c8a21b876dca2981fb4b830d72aad12cc176a948c029873159073c55122de3efb6ed8b9d2e2c9b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 b13ebbaa916caeb947b5cfe647254aba
SHA1 9f14797bac9241a5c8b8c5de95b970f268a6a51e
SHA256 68b37a30bb89b2b165ffe3da6b8c4d5b24a88db76d93c2d7068b05d663d64352
SHA512 af1ec682dfc366ffa13330de3206cbffaf9749a16179804e85fe0660c2a1ecf68590870cb0ce304ff8fb05b4cf2f039d196ed6e9893acac9811f304fabbd00f1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 04babba85019d89b13a3ef9629122cc7
SHA1 0b2113d60d414f893c71971de74eda3d7e04e835
SHA256 7cdd162ab5dcfe6d48d39c5698191937fa9a47c756fc1616be38d076c94be377
SHA512 eac0153ebe56a7bd13fde27ec0c7110d3c94cdd79af36f4637dc1efea47f1b4ad5751345e06b73d0e5e79a8d4b8cda4312bbac0ea064357ac602f885d5d02016

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 faed03cb2e708b5d4c38f1c7b6e7b5d4
SHA1 4beb2004b24ff1d9f45109fc747e1cd3a431a220
SHA256 556be3b1cabf4d145efe3388b719dbe45c4dfe3e754c92783d55e55ba9e19827
SHA512 fc9f679247189abf79f1219cb7b400e646a7d34019a3e6372b74c418d3099bb76f3b1b10b1b03b8689990a57f1910013ff2b6a97856d0b6b3877582c4ac9cd8a

memory/5708-1391-0x0000000002100000-0x0000000002B39000-memory.dmp

C:\ProgramData\FileCenter\Logs\Hooks_Last.txt

MD5 34d2701eb65edf48a974a92eb049513c
SHA1 3303a25b98043e964c7ddd2c70e2b4f7b425fc71
SHA256 e668a308bc06355ed17a9f4e65673885addebba5ae22151e53ba9e6ca83c2165
SHA512 43fd0110519fdd7d2794dd9398eb4bc4f72e59291e7e4ea19cc4a44a6fbd2f86ec602b3bed6c7ed35b75c5323654c1d09893cbb2c52eae69fadb8dbdc95a9683

C:\ProgramData\FileCenter\MRUPDFEditor.ini

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\ProgramData\FileCenter\ColumnStatesCab.ini

MD5 c085fbcff41848caba96006fe269ee66
SHA1 7699c00b4007d7411f273c14520bde6287839ac2
SHA256 430e377c78f8ae5bd5f088e83d31178b53306270457144c8ad56a5643cd9edbc
SHA512 c6e71cc4dd3c2c4d01906c61bc4c4fc0061e90690448f51b18e3d80efc664e59d541f7dc5f6bfc9952ff522555dd31cca06325643ea060d46a93c83a3ff34e8b

C:\ProgramData\FileCenter\ColumnStatesCab.ini

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/860-1757-0x0000000000F10000-0x0000000002528000-memory.dmp

memory/860-1762-0x0000000002BF0000-0x0000000003629000-memory.dmp

memory/860-1761-0x0000000000F10000-0x0000000002528000-memory.dmp

memory/5708-1764-0x0000000002100000-0x0000000002B39000-memory.dmp

memory/5708-1763-0x00000000008B0000-0x0000000001CF6000-memory.dmp