From 6f0badf0c204de0c04daab1cdb5113b8cb150c36 Mon Sep 17 00:00:00 2001 From: cyril Date: Thu, 27 Apr 2023 17:22:25 +0200 Subject: [PATCH] ajout sysmon config file --- deploiment.ps1 | 44 + sysmonconfig.xml | 2508 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2552 insertions(+) create mode 100644 deploiment.ps1 create mode 100644 sysmonconfig.xml diff --git a/deploiment.ps1 b/deploiment.ps1 new file mode 100644 index 0000000..645c024 --- /dev/null +++ b/deploiment.ps1 @@ -0,0 +1,44 @@ +$gitLabRepoUrl = "https://gitlab.altinea.fr/cyril.gorse/EDR" +$filePath = "edrV2.ps1" +$downloadUrl = "$gitLabRepoUrl/raw/master/$filePath" +$downloadFolder = "$altineaFolderPath\install" +$savePath = Join-Path $downloadFolder $filePath +$altineaFolderPath = "C:\altinea" + +# Vérifier si le dossier Altinea existe, sinon le créer +if (!(Test-Path $altineaFolderPath)) { + New-Item -ItemType Directory -Path $altineaFolderPath | Out-Null + # Définir le dossier Altinea comme un dossier caché + (Get-Item $altineaFolderPath).Attributes = 'Hidden' +} +if (!(Test-Path $downloadFolder)) { + New-Item -ItemType Directory -Path $downloadFolder | Out-Null + } +Invoke-WebRequest -Uri $downloadUrl -OutFile $savePath + +Write-Host "Le fichier a été téléchargé avec succès dans le dossier Altinea." + +# Exécuter le script téléchargé +Write-Host "Exécution du script téléchargé..." +& $savePath + +$taskName = "AltiCSInstall" +$scriptPath = "C:\altinea\install\$filepath" + +# Vérifier si la tâche planifiée existe déjà +$existingTask = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue + +if ($existingTask -eq $null) { + # Créer un déclencheur pour le démarrage de l'ordinateur + $trigger = New-ScheduledTaskTrigger -AtStartup + + # Créer une action pour exécuter le script PowerShell + $action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File `"$scriptPath`"" + + # Créer une tâche planifiée + Register-ScheduledTask -TaskName $taskName -Trigger $trigger -Action $action -User "SYSTEM" + + Write-Host "La tâche planifiée '$taskName' a été créée avec succès." +} else { + Write-Host "La tâche planifiée '$taskName' existe déjà." +} diff --git a/sysmonconfig.xml b/sysmonconfig.xml new file mode 100644 index 0000000..7ffde5b --- /dev/null +++ b/sysmonconfig.xml @@ -0,0 +1,2508 @@ + + + + + + + + + + + + + + + + + + + + + * + + False + + False + + Sysmon + + + + + + sethc.exe + utilman.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + sdbinst.exe + bitsadmin.exe + + eventvwr.exe + c:\windows\system32\mmc.exe + + fodhelper.exe + + -Embedding + c:\windows\system32\mmc.exe + + + Set-MpPreference + -DisableRealTimeMonitoring $true;-DisableBehaviorMonitoring $true;-DisableBlockAtFirstSeen $true;-DisableIOAVProtection $true;-DisablePrivacyMode $true;-SignatureDisableUpdateOnStartupWithoutEngine $true;-DisableArchiveScanning $true;-DisableIntrusionPreventionSystem $true;-DisableScriptScanning $true + + ^ + ../../ + C:\Windows\explorer.exe + C:\Windows\explorer.exe + + fltMC.exe + unload;detach + + + fltMC.exe + misc::mflt + + + InstallUtil.exe + /logfile=;/LogToConsole=false;/U + + rundll32.exe + werfault.exe + whoami.exe + ipconfig.exe + tasklist.exe + systeminfo.exe;sysinfo.exe + netstat.exe + qprocess.exe + nslookup.exe + net.exe;net1.exe + quser.exe + query.exe + tracert.exe + tree.com + route.exe + runas.exe + reg.exe + taskkill.exe + netsh.exe + klist.exe + wevtutil.exe + fsutil.exe + taskeng.exe + regsvr32.exe + wmiprvse.exe + wmiprvse.exe + hh.exe + hh.exe + + hh.exe + .exe + + cmd.exe + cmd.exe + powershell.exe + powershell.exe + powershell_ise.exe + bash.exe + odbcconf.exe + pcalua.exe + cscript.exe + wscript.exe + pcalua.exe + cscript.exe + wscript.exe + + csc.exe + -target:library + .cs + + + csc.exe + -out: + .cs + + + cscript.exe + .js + + mshta.exe + control.exe + mshta.exe + attrib.exe + cmdkey.exe + + cmdkey.exe + /list + + At.exe + nbtstat.exe;nbtinfo.exe + qwinsta.exe + rwinsta.exe + schtasks.exe;sctasks.exe + replace.exe + jjs.exe + appcmd.exe + sc.exe + certutil.exe + findstr.exe + where.exe + forfiles.exe + icacls.exe;cacls.exe + xcopy.exe + robocopy.exe + takeown.exe + makecab.exe + wusa.exe + vssadmin.exe + nltest.exe;nltestk.exe + winrs.exe + computerdefaults.exe + dism.exe + fodhelper.exe + mofcomp.exe + Microsoft.Workflow.Compiler.exe + C:\WINDOWS\system32\wbem\scrcons.exe + ScrCons + + esentutl.exe + /y;/vss/d + + vssadmin.exe;delete + wbadmin.exe;delete + bcedit.exe;set + rundll32.exe dfshim.dll,ShOpenVerbApplication http:// + diskshadow.exe + diskshadow.exe;/s + diskshadow.exe;-s + diskshadow.exe + expand.exe + ftp.exe + GfxDownloadWrapper.exe + ieexec.exe http + ilasm + installutil.exe + jsc.exe + msdt.exe + rasautou.exe + + print.exe + : + + + regedit.exe + : + + Register-cimprovider.exe + rpcping.exe + runscripthelper.exe surfacecheck + Scriptrunner.exe -appvscript + Scriptrunner.exe + tttracer.exe + vbc.exe /target:exe + vbc.exe + wab.exe + wsreset.exe + xwizard RunWizard + Appvlp.exe + bginfo + bginfo + cbd + csi.exe + csi.exe + devtoolslauncher.exe LaunchForDeploy + devtoolslauncher.exe + dnx.exe;consoleapp + + dotnet.exe + .dll + + + pester + winrm + slmgr + pubprn + manage-bde + CL_Invocation + CL_Mutexverifiers + wsl.exe + vsjitdebugger.exe + vsjitdebugger + update;--download + update.exe;--update + update.exe;--ProcessStart + tracker.exe + te.exe + squirrel;--download + squirrel.exe;--update + Sqlps.exe + sqldumper.exe + rcsi.exe + + ntdsutil.exe + ifm + + msxls.exe + msdeploy.exe -verb:sync -source:RunCommand + mftrace.exe + dxcap.exe + dxcap.exe;-c + dxcap.exe;/c + taskmgr.exe + regedit.exe + netsh.exe + taskeng.exe + regsvr32.exe + cmd.exe + cmd.exe + powershell.exe + powershell.exe + powershell_ise.exe + mshta.exe + mshta.exe + attrib.exe + schtasks.exe;sctasks.exe + sc.exe + desktopimgdownldr.exe + findstr.exe + where.exe + computerdefaults.exe + dism.exe + fodhelper.exe + djoin.exe + PktMon.exe + C:\WINDOWS\system32\wbem\scrcons.exe + + esentutl.exe + /y;/vss/d + + + nltestrk.exe + /domain_trusts + + ATBroker.exe + csc.exe + dfsvc.exe + dnscmd.exe + esentutl.exe + expand + extexport.exe + extrac32.exe + IEExec.exe + ilasm.exe + InfDefaultInstall.EXE + jsc.exe + vbc.exe + Microsoft.Workflow.Compiler.exe + msconfig.EXE + msiexec.exe + odbcconf.exe + PresentationHost.exe + Print.Exe + rasdlui.exe + RegisterCimProvider2.exe + RegisterCimProvider.exe + ScriptRunner.exe + TTTracer.exe + verclsid.exe + wab.exe + WSReset.exe + xwizard.exe + curl.exe + + Mavinject.exe;mavinject64.exe + /INJECTRUNNING + + + CMSTP.exe + /ni;/s + + MSBuild.exe + excel.exe + winword.exe + powerpnt.exe + outlook.exe + msaccess.exe + mspub.exe + regsvcs.exe;regasm.exe + FromBase64 + gzip + decompress + http + replace + SyncAppvPublishingServer.exe + PsList.exe + PsService.exe + PsExec.exe + PsExec.c + PsGetSID.exe + PsKill.exe + PKill.exe + ProcDump + PsLoggedOn.exe + PsFile.exe + ShellRunas + PipeList.exe + AccessChk.exe + AccessEnum.exe + LogonSessions.exe + PsLogList.exe + PsInfo.exe + LoadOrd + PsPasswd.exe + ru.exe + Regsize + ProcDump + -ma lsass.exe + -accepteula -ma + + vssadmin.exe + delete;shadow + + + vssadmin.exe + resize;shadowstorage + + + wmic.exe + delete;shadowcopy + + + wbadmin.exe + delete;catalog + + + bcdedit.exe + recoveryenabled;no + + + bcdedit.exe + bootstatuspolicy;ignoreallfailures + + C:\PerfLogs\ + C:\$Recycle.bin\ + C:\Intel\Logs\ + C:\Users\Default\ + C:\Users\Public\ + C:\Users\NetworkService\ + C:\Windows\Fonts\ + C:\Windows\Debug\ + C:\Windows\Media\ + C:\Windows\Help\ + C:\Windows\addins\ + C:\Windows\repair\ + C:\Windows\security\ + C:\Windows\system32\config\systemprofile\ + VolumeShadowCopy + \htdocs\ + \wwwroot\ + \Temp\ + \Downloads\ + \Desktop\ + \Appdata\Local\ + + control;/name + rundll32.exe;shell32.dll;Control_RunDLL + + + MpCmdRun.exe + Add-MpPreference;RemoveDefinitions;DisableIOAVProtection + + wsmprovhost.exe + winrshost.exe + winrm.cmd + wsl.exe + wsl.exe;-e + wsl.exe;/e + wsl.exe;-e + wsl.exe;/e + wsl.exe;-u root + wsl.exe;/u root + wsl.exe;--exec bash + + wsl.exe;--exec bash + /dev/tcp + + + + + + + + AcroRd32.exe + /CR;channel= + + + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe + C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe + C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe + "C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" -Embedding + + "C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" + "C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs" + + C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe + C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe + C:\Program Files\NVIDIA Corporation\ + C:\Program Files\Realtek\ + C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + C:\Program Files\ESET\ESET Nod32 Antivirus\ekrn.exe + "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= + "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= + C:\Program Files (x86)\Google\Update\ + C:\Program Files (x86)\Google\Update\ + C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe + C:\Program Files (x86)\RES Software\Workspace Manager\respesvc64.exe + C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe + C:\Program Files (x86)\RES Software\Workspace Manager\ResPesvc64.exe + C:\Program Files\RES Software\Workspace Manager\respesvc.exe + C:\Program Files\Ivanti\Workspace Control\ResPesvc.exe + C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe + C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe + C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE + C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE + "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel + "C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel + C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe + C:\Program Files (x86)\Sophos\Sophos System Protection\ssp.exe + C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe + C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe + C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe + C:\Program Files\Splunk\bin\ + C:\Program Files\Splunk\bin\splunkd.exe + C:\Program Files\Splunk\bin\splunk.exe + D:\Program Files\Splunk\bin\ + D:\Program Files\Splunk\bin\splunkd.exe + D:\Program Files\Splunk\bin\splunk.exe + C:\Program Files\SplunkUniversalForwarder\bin\ + C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe + C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe + D:\Program Files\SplunkUniversalForwarder\bin\ + D:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe + D:\Program Files\SplunkUniversalForwarder\bin\splunk.exe + C:\Windows\system32\svchost.exe -k appmodel -s StateRepository + C:\Windows\system32\svchost.exe -k appmodel + C:\WINDOWS\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc + C:\Windows\system32\svchost.exe -k camera -s FrameServer + C:\Windows\system32\svchost.exe -k dcomlaunch -s LSM + C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlay + C:\Windows\system32\svchost.exe -k defragsvc + C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc + C:\Windows\system32\svchost.exe -k imgsvc + C:\Windows\system32\svchost.exe -k localService -s EventSystem + C:\Windows\system32\svchost.exe -k localService -s bthserv + C:\Windows\system32\svchost.exe -k localService -s nsi + C:\Windows\system32\svchost.exe -k localService -s w32Time + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc + C:\Windows\system32\svchost.exe -k localServiceNoNetwork + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost + C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted + C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvc + C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvc + C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC + C:\Windows\system32\svchost.exe -k netsvcs -s BITS + C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc + C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc + C:\Windows\system32\svchost.exe -k netsvcs -s Gpsvc + C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc + C:\Windows\system32\svchost.exe -k netsvcs -s SENS + C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv + C:\Windows\system32\svchost.exe -k netsvcs -s Themes + C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt + C:\Windows\system32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc + C:\Windows\system32\svchost.exe -k networkService -s Dnscache + C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation + C:\Windows\system32\svchost.exe -k networkService -s NlaSvc + C:\Windows\system32\svchost.exe -k networkService -s TermService + C:\Windows\system32\svchost.exe -k networkService + C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k rPCSS + C:\Windows\system32\svchost.exe -k secsvcs + C:\Windows\system32\svchost.exe -k swprv + C:\Windows\system32\svchost.exe -k unistackSvcGroup + C:\Windows\system32\svchost.exe -k utcsvc + C:\Windows\system32\svchost.exe -k wbioSvcGroup + C:\Windows\system32\svchost.exe -k werSvcGroup + C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC + C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc + C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC + C:\Windows\system32\svchost.exe -k wsappx + C:\Windows\system32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted + C:\Program Files\Trend Micro\Deep Security Agent\ds_monitor.exe + C:\Program Files\Trend Micro\Deep Security Agent\dsa.exe + C:\Program Files\Trend Micro\Deep Security Agent\dsuam.exe + C:\Program Files\Trend Micro\Deep Security Agent\Notifier.exe + C:\Program Files\Trend Micro\Deep Security Agent\lib\Patch.exe + C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe + C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmopExtIns32.exe + C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmExtIns.exe + C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmListen.exe + C:\Program Files\Windows Defender\ + C:\Windows\system32\MpSigStub.exe + C:\Windows\SoftwareDistribution\Download\Install\AM_ + C:\Program Files\Microsoft Security Client\MpCmdRun.exe + C:\Windows\system32\DllHost.exe /Processid + C:\Windows\system32\SearchIndexer.exe /Embedding + C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\MusNotification.exe + C:\Windows\System32\MusNotificationUx.exe + C:\Windows\System32\audiodg.exe + C:\Windows\System32\conhost.exe + C:\Windows\System32\powercfg.exe + C:\Windows\System32\wbem\WmiApSrv.exe + C:\Windows\System32\wermgr.exe + C:\Windows\SysWOW64\wermgr.exe + C:\Windows\system32\sppsvc.exe + AppContainer + %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows + C:\Windows\system32\SearchIndexer.exe + + + + + + C:\Temp + C:\Windows\Temp + C:\Tmp + C:\Users + + + + + + AppData\Local\Google\Chrome\Application\chrome.exe + Root\VFS\ProgramFilesX86\Google\Chrome\Application\chrome.exe + OneDrive.exe + setup + slack.exe + AppData\Local\Microsoft\Teams\current\Teams.exe + + + + + + vnc.exe + vncviewer.exe + vncservice.exe + winexesvc.exe + bitsadmin.exe + omniinet.exe + hpsmhd.exe + C:\Program Files\Microsoft\HybridConnectionManager + ipconfig.exe + tasklist.exe + netstat.exe + qprocess.exe + nslookup.exe + quser.exe + query.exe + runas.exe + reg.exe + netsh.exe + klist.exe + wevtutil.exe + taskeng.exe + regsvr32.exe + cmd.exe + powershell.exe + bash.exe + pcalua.exe + cscript.exe + wscript.exe + mshta.exe + nbtstat.exe + net1.exe + nslookup.exe + qwinsta.exe + rwinsta.exe + sc.exe + nltest.exe + winrs.exe + dfsvc.exe + dnscmd.exe + esentutl.exe + expand.exe + extrac32.exe + IEExec.exe + Msdt.exe + msiexec.exe + Print.Exe + RegisterCimProvider.exe + RpcPing.exe + ScriptRunner.exe + xwizard.exe + desktopimgdownldr.exe + OpenConsole.exe + WindowsTerminal.exe + dllhost.exe + ipconfig.exe + tasklist.exe + netstat.exe + qprocess.exe + nslookup.exe + net.exe + quser.exe + query.exe + runas.exe + reg.exe + netsh.exe + klist.exe + wevtutil.exe + taskeng.exe + regsvr32.exe + hh.exe + cmd.exe + powershell.exe + bash.exe + pcalua.exe + cscript.exe + wscript.exe + mshta.exe + nbtstat.exe + net1.exe + nslookup.exe + qwinsta.exe + rwinsta.exe + schtasks.exe + taskkill.exe + sc.exe + nltest.exe + winrs.exe + dfsvc.exe + dnscmd.exe + esentutl.exe + expand.exe + extrac32.exe + IEExec.exe + Msdt.exe + msiexec.exe + Print.Exe + RegisterCimProvider.exe + RpcPing.exe + ScriptRunner.exe + xwizard.exe + desktopimgdownldr.exe + Mavinject.exe + at.exe + certutil.exe + cscript.exe + java.exe + mshta.exe + msiexec.exe + net.exe + notepad.exe + reg.exe + regsvr32.exe + rundll32.exe + sc.exe + wmic.exe + wscript.exe + driverquery.exe + dsquery.exe + AdFind.exe + hh.exe + infDefaultInstall.exe + javaw.exe + javaws.exe + mmc.exe + msbuild.exe + nbtstat.exe + nslookup.exe + qprocess.exe + qwinsta.exe + regsvcs.exe + rwinsta.exe + schtasks.exe + taskkill.exe + replace.exe + 1080 + 3128 + 8080 + 22 + 23 + 25 + + 88 + C:\Windows\System32\lsass.exe + + 3389 + 5800 + 5900 + 5985 + 5986 + psexec.exe + psexesvc.exe + + 445;389;8492;636;3268;3269 + C:\Windows\System32\lsass.exe + c:\Windows\System32\dsamain.exe + 4 + + C:\Users + C:\ProgramData + C:\Windows\Temp + C:\Temp + C:\PerfLogs\ + C:\$Recycle.bin\ + C:\Intel\Logs\ + C:\Users\Default\ + C:\Users\Public\ + C:\Users\NetworkService\ + C:\Windows\Fonts\ + C:\Windows\Debug\ + C:\Windows\Media\ + C:\Windows\Help\ + C:\Windows\addins\ + C:\Windows\repair\ + C:\Windows\security\ + C:\Windows\system32\config\systemprofile\ + \htdocs\ + \wwwroot\ + \AppData\Local\ + \AppData\Local\Temp\ + \AppData\Roaming\ + \AppData\LocalLow\ + C:\Windows\SysWOW64 + SyncAppvPublishingServer.exe + tor.exe + 1723 + 4500 + 9001 + 9030 + 5985 + 5986 + + + + + + AppData\Roaming\Dropbox\bin\Dropbox.exe + winlogbeat.exe + packetbeat.exe + C:\Program Files\ESET\ESET Nod32 Antivirus\ekrn.exe + + C:\Windows\System32\lsass.exe + 88 + + OneDrive.exe + OneDriveStandaloneUpdater.exe + ownCloud\owncloud.exe + C:\Program Files\Palo Alto Networks\Traps\cyserver.exe + + udp + 3389 + + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe + C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe + C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe + C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe + AppData\Roaming\Spotify\Spotify.exe + AppData\Local\SynologyDrive\SynologyDrive.app\bin\cloud-drive-ui.exe + AppData\Local\SynologyDrive\SynologyDrive.app\bin\cloud-drive-daemon.exe + C:\Program files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe + C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe + .windowsupdate.microsoft.com + .windowsupdate.com + wustat.windows.com + go.microsoft.com + .update.microsoft.com + download.microsoft.com + microsoft.com.akadns.net + microsoft.com.nsatc.net + + + + + + C:\Users + C:\Temp + C:\Windows\Temp + + + + + + + + Intel + Valid + + + Microsoft + Valid + + + + + + + + amsi.dll + powershell.exe;powershell_ise.exe + + + bginfo.exe + System.ni.dll;System.Core.ni.dll + + bitsproxy.dll + + clr.dll + C:\Windows\Microsoft.NET\ + + + clrjit.dll + C:\Windows\Microsoft.NET\ + + + mscoreei.dll + C:\Windows\Microsoft.NET\ + + + mscoree.dll + C:\Windows\Microsoft.NET\ + + + mscoreeis.dll + C:\Windows\Microsoft.NET\ + + + mscorlib.dll + C:\Windows\Microsoft.NET\ + + + mscorlib.ni.dll + C:\Windows\Microsoft.NET\ + + mstask.dll + wshom.ocx + scrrun.dll + vbscript.dll + + jscript.dll + mshta.exe + + + jscript9.dll + mshta.exe + + .wll + .xll + + C:\Program Files;\Microsoft Office\root\Office + combase.dll + + + C:\Program Files;\Microsoft Office\root\Office + coml2.dll + + + C:\Program Files;\Microsoft Office\root\Office + comsvcs.dll + + + C:\Program Files;\Microsoft Office\root\Office + C:\Windows\assembly\ + + + C:\Program Files;\Microsoft Office\root\Office + C:\Windows\Microsoft.NET\assembly\GAC_MSIL + + + C:\Program Files;\Microsoft Office\root\Office + clr.dll + + + C:\Program Files;\Microsoft Office\root\Office + VBE7INTL.DLL + + + C:\Program Files;\Microsoft Office\root\Office + VBE7.DLL + + + C:\Program Files;\Microsoft Office\root\Office + VBEUI.DLL + + + C:\Program Files;\Microsoft Office\root\Office + OUTLVBA.DLL + + VSTOInstaller.exe + + C:\Program Files;\Microsoft Office\root\Office + C:\Windows\SysWOW64\wbem\wbemdisp.dll + + system.management.automation.ni.dll + system.management.automation.dll + Microsoft.PowerShell.Commands.Diagnostics.dll + Microsoft.PowerShell.Commands.Management.dll + Microsoft.PowerShell.Commands.Utility.dll + Microsoft.PowerShell.ConsoleHost.dll + Microsoft.PowerShell.Security.dll + C:\Windows\System32\spool\drivers\ + regsvc.dll + + rundll32.exe + comsvcs.dll + + taskschd.dll + scrobj.dll + scrobj.dll + admin$;c$;\\;\appdata\;\temp\ + c:\programdata\ + C:\Windows\Media\ + C:\Windows\addins\ + C:\Windows\system32\config\systemprofile\ + C:\Windows\Debug\ + C:\Windows\Temp + C:\PerfLogs\ + C:\Windows\Help\ + C:\Intel\Logs\ + C:\Temp + C:\Windows\repair\ + C:\Windows\security\ + C:\Windows\Fonts\ + Downloads + Public + Documents + Music + Video + file: + $Recycle.bin\ + \Windows\IME\ + + urlmon.dll + + wmiutils.dll + + + + + + + C:\Windows\System32\cscript.exe + scrobj.dll + + + VSTOInstaller.exe + C:\Windows\ + + + C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe + C:\Users\;\AppData\Local\Microsoft\OneDrive\;\FileSyncTelemetryExtensions.dll + + + C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe + C:\Users\;\AppData\Local\Microsoft\OneDrive\;\FileCoAuthLib.dll + + + C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe + C:\Users\;\AppData\Local\Microsoft\OneDrive\;\OneDriveTelemetryStable.dll + + + C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe + C:\Users\;\AppData\Local\Microsoft\OneDrive\;\vcruntime140.dll + + + C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe + C:\Users\;\AppData\Local\Microsoft\OneDrive\;\UpdateRingSettings.dll + + + C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe + C:\Users\;\AppData\Local\Microsoft\OneDrive\;\LoggingPlatform.dll + + + C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe + C:\Users\;\AppData\Local\Microsoft\OneDrive\;\FileCoAuth.exe + + + + + + + + C:\Windows\System32\svchost.exe + C:\Windows\System32\wininit.exe + C:\Windows\System32\csrss.exe + C:\Windows\System32\services.exe + C:\Windows\System32\winlogon.exe + C:\Windows\System32\audiodg.exe + + C:\Windows\System32\dwm.exe + C:\Windows\System32\csrss.exe + + Google\Chrome\Application\chrome.exe + C:\Windows\System32\wbem\WmiPrvSE.exe + + + + + + + + + + dbghelp.dll + dbgcore.dll + Desktop + + C:\Windows\system32\csrss.exe + 0x1F1FFF + + + C:\Windows\system32\wininit.exe + 0x1F1FFF + + + C:\Windows\system32\winlogon.exe + 0x1F1FFF + + + C:\Windows\system32\services.exe + 0x1F1FFF + + 0x21410 + + C:\Windows\system32\lsass.exe + 0x1FFFFF + + + C:\Windows\system32\lsass.exe + 0x1F1FFF + + + C:\Windows\system32\lsass.exe + 0x1010 + + + C:\Windows\system32\lsass.exe + 0x143A + + + lsass.exe + wsmprovhost.exe + + + C:\Program Files;\Microsoft Office\Root\Office + \Microsoft Shared\VBA + + + C:\Windows\SYSTEM32\ntdll.dll;C:\Windows\System32\kernelbase.dll;UNKNOWN + 0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF;0x147A + + 0x0800 + 0x0810 + 0x0820 + 0x800 + 0x810 + 0x820 + C:\PerfLogs\ + C:\$Recycle.bin\ + C:\Intel\Logs\ + C:\Users\Default\ + C:\Users\Public\ + C:\Users\NetworkService\ + C:\Windows\Fonts\ + C:\Windows\Debug\ + C:\Windows\Media\ + C:\Windows\Help\ + C:\Windows\addins\ + C:\Windows\repair\ + C:\Windows\security\ + C:\Windows\system32\config\systemprofile\ + VolumeShadowCopy + \htdocs\ + \wwwroot\ + \Temp\ + + \AppData\ + \AppData\Local\Microsoft\Teams\current\Teams.exe + + + System.Management.Automation.ni.dll + C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe + + + C:\Windows\SYSTEM32\ntdll.dll + C:\Windows\SYSTEM32\win32u.dll + C:\Windows\SYSTEM32\wow64win.dll + + + + + + + C:\Program Files\Adobe\Adobe Creative Cloud Experience\libs\node.exe + C:\Program Files;\Common Files\Adobe\AdobeGCClient\AGMService.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrobat.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe + C:\Program Files\Adobe\Adobe Photoshop 2021\Photoshop.exe + C:\Program Files\Autodesk\Autodesk Desktop App + C:\Program Files (x86)\Autodesk\Autodesk Desktop App + C:\Windows\CarbonBlack\cb.exe + C:\Program Files\Cisco\AMP\;sfc.exe + C:\Users\;\AppData\Local\Citrix\ICA Client\receiver\Receiver.exe + C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe + c:\Program Files\Couchbase\Server\bin\sigar_port.exe + C:\Program Files\Elastic\Agent\data\;\metricbeat.exe + C:\Program Files;\FireEye\xagt\xagt.exe + C:\Program Files (x86)\Ivanti\Workspace Control\cpushld.exe + C:\Program Files (x86)\RES Software\Workspace Manager\cpushld.exe + C:\Program Files\Ivanti\Workspace Control\cpushld.exe + C:\Program Files\RES Software\Workspace Manager\cpushld.exe + wmiprvse.exe + GoogleUpdate.exe + LTSVC.exe + taskmgr.exe + VBoxService.exe + vmtoolsd.exe + \Citrix\System32\wfshell.exe + C:\Windows\System32\lsm.exe + Microsoft.Identity.AadConnect.Health.AadSync.Host.exe + C:\Program Files (x86)\Symantec\Symantec Endpoint Protection + 0x1000 + 0x1400 + 0x101400 + 0x101000 + C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe + C:\Program Files\McAfee\Agent\x86\macompatsvc.exe + C:\Users\;\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe + C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE + C:\Program Files\PowerToys\modules\KeyboardManager\KeyboardManagerEngine\PowerToys.KeyboardManagerEngine.exe + + C:\Users\;\AppData\Local\Microsoft\Teams\current\Teams.exe + C:\Users\;\AppData\Local\Microsoft\Teams\current\Teams.exe + + C:\Program Files\Microsoft Security Client\MsMpEng.exe + C:\Program Files\Windows Defender\MsMpEng.exe + C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe + C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe + C:\Program Files\Palo Alto Networks\Traps\cyserver.exe + C:\Program Files\Qualys\QualysAgent\QualysAgent.exe + C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe + C:\WINDOWS\CCM\CcmExec.exe + C:\Program Files\Splunk\bin\splunkd.exe + + C:\Program Files\Microsoft VS Code\Code.exe + C:\Program Files\Microsoft VS Code\Code.exe + 0x100000 + + + C:\Program Files\Microsoft VS Code\Code.exe + C:\Program Files\Microsoft VS Code\Code.exe + 0x1401 + + C:\Program Files (x86)\VMware\VMWare Player\vmware-authd.exe + C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe + C:\Program Files\WinZip\FAHWindow64.exe + + + + + + C:\Windows\AppPatch\Custom + .bat + .cmd + .chm + C:\Users\;\.azure\accesstokens.json + C:\Users\;\.aws\credentials + C:\Users\;\config\gcloud + C:\Users\;\.alibabacloud\credentials + C:\Users\;\.kube\config + C:\Users\;\.ssh\ + C:\Users\Default + Desktop + AppData\Local\Microsoft\CLR_v2.0\UsageLogs\ + \UsageLogs\cscript.exe.log + \UsageLogs\wscript.exe.log + \UsageLogs\wmic.exe.log + \UsageLogs\mshta.exe.log + \UsageLogs\svchost.exe.log + \UsageLogs\regsvr32.exe.log + \UsageLogs\rundll32.exe.log + \Downloads\ + C:\Windows\System32\Drivers + C:\Windows\SysWOW64\Drivers + + .js + Appdata\Local\whatsapp\ + Appdata\Local\whatsapp\ + + + .js + Appdata\Local\Microsoft\Teams\ + Appdata\Local\Microsoft\Teams\ + + + .js + Appdata\Local\slack\ + Appdata\Local\slack\ + + + .js + Appdata\Local\discord\ + Appdata\Local\discord\ + + + .js + Appdata\Local\signal\ + Appdata\Local\signal\ + + .exe + C:\Windows\System32\GroupPolicy\Machine\Scripts + C:\Windows\System32\GroupPolicy\User\Scripts + .hta + .iso + .img + .js + .javascript + .kirbi + .lnk + .scf + .application + .appref-ms + .*proj + .sln + .settingcontent-ms + .docm + .pptm + .xlsm + .xlm + .dotm + .xltm + .potm + .ppsm + .sldm + .xlam + .xla + .iqy + .slk + \Content.Outlook\ + Roaming\Microsoft\Outlook\VbaProject.OTM + .rwz + Roaming\Microsoft\Outlook\Outlook.xml + .rft + .jsp + .jspx + .asp + .aspx + .php + .war + .ace + C:\Windows\System32\WindowsPowerShell + C:\Windows\SysWOW64\WindowsPowerShell + .ps1 + .ps2 + .py + .pyc + .pyw + .rdp + rundll32.exe + C:\Windows\System32\Tasks + C:\Windows\Tasks\ + \Start Menu + \Startup + C:\Windows\SysWoW64 + C:\Windows\System32 + C:\Windows\ + .sys + \*lsass*.dmp\ + taskmgr.exe + .url + .vb + .vbe + .vbs + + C:\Windows\System32\CodeIntegrity\CIPolicies\Active\ + .cip + + + C:\Windows\System32\CodeIntegrity\ + .p7b + + C:\Windows\System32\Wbem + C:\Windows\SysWOW64\Wbem + C:\WINDOWS\system32\wbem\scrcons.exe + C:\Windows\Temp\ + C:\Program\ + C:\Temp\ + C:\PerfLogs\ + C:\Users\Public\ + \AppData\Temp\ + + + + + + C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe + + C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe + C:\Program Files\Elastic\Endpoint\state\last-document-id.json + + + C:\Program Files\Elastic\Agent\data\ + C:\Program Files\Elastic\Agent\data\;.ndjson + + C:\Windows\system32\igfxCUIService.exe + C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe + C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Windows\System32\smss.exe + C:\Windows\system32\CompatTelRunner.exe + C:\Windows\system32\wbem\WMIADAP.EXE + C:\Windows\System32\DriverStore\Temp\ + C:\Windows\System32\wbem\Performance\ + WRITABLE.TST + \AppData\Roaming\Microsoft\Windows\Recent\ + C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\ + C:\WINDOWS\winsxs\amd64_microsoft-windows + c:\Program Files\Microsoft Security Client\MsMpEng.exe + + Outlook.exe + Roaming\Microsoft\Outlook\Outlook.xml + + c:\windows\system32\provtool.exe + + C:\Windows\system32\wsmprovhost.exe + C:\Users\;\AppData\Local\Temp;__PSScriptPolicyTest;.ps1 + + + C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe + C:\Windows\Temp;__PSScriptPolicyTest;.ps1 + NT AUTHORITY\SYSTEM + + C:\WINDOWS\CCM\CcmExec.exe + C:\Windows\CCM + C:\Windows\System32\Tasks\Microsoft\Windows\PLA\FabricTraces + C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask + C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleUsageCollector + C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerCeipAssistant + + + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + \CurrentVersion\Run + \Group Policy\Scripts + \Windows\System\Scripts + \Policies\Explorer\Run + \ServiceDll + \ImagePath + \Start + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Specialaccounts\userlist + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Uihostl + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SYSTEM\;Control\Session Manager\BootExecute + HKLM\SYSTEM\;Control\Session Manager\excludefromknowndlls + HKLM\SYSTEM\;Control\Session Manager\safedllsearchmode + HKLM\SYSTEM\;Control\Session Manager\setupexecute + \Explorer\FileExts + \shell\install\command + \shell\open\command + \shell\open\ddeexec + Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup + software\microsoft\windows nt\currentversion\accessibility\ATs\;\StartExe + software\microsoft\windows nt\currentversion\windows\run\ + Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\ + software\microsoft\windows\currentversion\explorer\shell folders\common startup + software\microsoft\windows\currentversion\explorer\shell folders\startup + hklm\software\microsoft\command processor\autorun + \mscfile\shell\open\command + ms-settings\shell\open\command + Classes\exefile\shell\runas\command\isolatedCommand + Software\Classes\CLSID;inprocserver32 + Software\Classes\CLSID;localserver32 + Classes\CLSID\;TreatAs + System\CurrentControlSet\Services\VSS + \services\Netlogon\Parameters\DisablePasswordChange + HKLM\SOFTWARE\;Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls + HKLM\SOFTWARE\;Microsoft\Windows NT\CurrentVersion\Windows\loadappinit_dlls + \SYSTEM\;\Services\DNS\Parameters\ServerLevelPluginDll + SOFTWARE\Microsoft\.NETFramework\ETWEnabled + \Environment\ + HKLM\SYSTEM\setup\cmdline + HKLM\SYSTEM\setup\upgrade + Software\microsoft\ctf\langbaraddin\;\Enable + Software\microsoft\ctf\langbaraddin\;\FilePath + Software\policies\microsoft\windows\control panel\desktop\scrnsave.exe + HKLM\Software\Classes\protocols\filter\ + HKLM\Software\Classes\protocols\handler\ + \SYSTEM\;\Service\EventLog;Retention + \SYSTEM\;\Service\EventLog;MaxSize + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + \Internet Explorer\Toolbar + \Internet Explorer\Extensions + \Browser Helper Objects + \software\microsoft\internet explorer\desktop\components\Source + \software\microsoft\internet explorer\explorer bars\ + \software\microsoft\internet explorer\Styles\MaxScriptStatements + \software\microsoft\internet explorer\toolbar\WebBrowser\ITBarLayout + \software\wow6432node\microsoft\internet explorer\toolbar\WebBrowser\ITBarLayout + \software\microsoft\internet explorer\urlsearchhooks\ + HKLM\software\wow6432node\microsoft\internet explorer\urlsearchhooks\ + HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors + hklm\system\mounteddevices\ + hklm\system\;\enum\usb\ + SOFTWARE\Microsoft\Netsh + \Microsoft\Office;\Outlook\Addins + \Software\Microsoft\VSTO\Security\Inclusion + \Software\Microsoft\VSTO\SolutionMetadata + Identities + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Account Name + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Display Name + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Email + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\MAPI Provider + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP User + software\microsoft\office\;\outlook\security\ + software\microsoft\office\;\outlook\today\ + software\microsoft\office\;\outlook\webview\;\ + software\microsoft\office\;\word\options\globaldotname + software\microsoft\office\;\common\internet\server cache\ + software\;microsoft\office\;\addins\ + software\;microsoft\office\;\Common\COM Compatibility + \Security\Trusted Documents\TrustRecords + \Security\Trusted Documents\ + \UrlUpdateInfo + software\microsoft\windows\currentversion\explorer\recentdocs\.docx\ + software\microsoft\windows\currentversion\explorer\recentdocs\.xlsx\ + HKLM\SOFTWARE\Clients\Mail\Microsoft Outlook\DllPath + HKLM\SOFTWARE\Clients\Mail\Microsoft Outlook\DllPathEx + software\microsoft\Office test\special\perf\ + software\microsoft\office\;\Options\OPEN + \Microsoft\Office;\PowerPoint\Addins + \Word\Security\AllowDDE + \Excel\Security\DisableDDEServerLaunch + \Excel\Security\DisableDDEServerLookup + \VBAWarnings + \DisableInternetFilesInPV + \DisableUnsafeLocationsInPV + \DisableAttachementsInPV + HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\MaxInstanceCount + HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\RaunSolicit + HKLM\SYSTEM\CurrentControlSet\services\TermService\Parameters\ServiceDll + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fSingleSessionPerUser + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections + HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Shadow + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks;Actions + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ + SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe + HKLM\SYSTEM\CurrentControlSet\Services + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\Microsoft\Cryptography\Offload\ExpoOffload + \PsExec\EulaAccepted + \PsFile\EulaAccepted + \PsGetSID\EulaAccepted + \PsInfo\EulaAccepted + \PsKill\EulaAccepted + \PsList\EulaAccepted + \PsLoggedOn\EulaAccepted + \PsLogList\EulaAccepted + \PsPasswd\EulaAccepted + \PsService\EulaAccepted + \PsShutDown\EulaAccepted + \PsSuspend\EulaAccepted + SYSTEM\CurrentControlSet\services\SysmonDrv + SYSTEM\CurrentControlSet\services\Sysmon + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders + HKLM\Software\Microsoft\WAB\DLLPath + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Control.exe + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls + software\classes\clsid\{083863f1-70de-11d0-bd40-00a0c911ce86}\instance + software\classes\clsid\{7ed96837-96f0-4812-b211-f13c24117ed3}\instance + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\bluetooth + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\usb + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\contacts + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\humanInterfaceDevice + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Plap Providers + HKLM\SYSTEM\CurrentControlSet\Control\Lsa + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\ + \Control\SecurityProviders\WDigest + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender + HKLM\software\lmicrosoft\microsoft antimalware\exclusions\ + HKLM\software\microsoft\Windows Advanced Threat Protection\TelLib + HKLM\software\policies\microsoft\windows advanced threat protection\ + + HKLM\SYSTEM\CurrentControlSet\Services\Sense +
DWORD (0x00000004)
+ + + HKLM\SYSTEM\CurrentControlSet\Services\WinDefend +
DWORD (0x00000004)
+ + + HKLM\SYSTEM\CurrentControlSet\Services\MsMpSvc +
DWORD (0x00000004)
+ + + HKLM\SYSTEM\CurrentControlSet\Services\NisSrv +
DWORD (0x00000004)
+ + + HKLM\SYSTEM\CurrentControlSet\Services\WdBoot +
DWORD (0x00000004)
+ + + HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv +
DWORD (0x00000004)
+ + + HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc +
DWORD (0x00000004)
+ + + HKLM\SYSTEM\CurrentControlSet\Services\wscsvc +
DWORD (0x00000004)
+ + + HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService +
DWORD (0x00000004)
+ + + HKLM\SYSTEM\CurrentControlSet\Services\wuauserv +
DWORD (0x00000004)
+ + + HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc +
DWORD (0x00000004)
+ + hklm\software\microsoft\windows script\settings\amsienable + \software\microsoft\windows script\settings\amsienable + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + HKLM\software\policies\microsoft\windowsfirewall\;\authorizedapplications + HKLM\software\policies\microsoft\windowsfirewall\;\authorizedapplications\list + HKLM\software\policies\microsoft\windowsfirewall\;\globallyopenports + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon + \FriendlyName + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + C:\Windows\System32\svchost.exe + + + \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + C:\Windows\System32\svchost.exe + + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports + \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports + HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging + HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging + HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription + software\microsoft\powershell\;\shellids\microsoft.powershell\executionpolicy + HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates + \Microsoft\SystemCertificates\Root\Certificates + \Microsoft\SystemCertificates\CA\Certificates + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + \Classes\AllFilesystemObjects + \Classes\Directory + \Classes\Drive + \Classes\Folder + \ShellEx\ContextMenuHandlers + \CurrentVersion\Shell + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObject + HKLM\SOFTWARE\Microsoft\Windows;\CurrentVersion\Print\Connections + HKLM\System;\control\print\monitors + \Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUsername + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + HKU;Environment + HKLM;Environment + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\Pending\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\PostRebootReporting\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\ + HKLM\SYSTEM\CurrentControlSet\Services\WinSock + \ProxyServer + SYSTEM\CurrentControlSet\Control\CrashControl + HKLM\SYSTEM\;Control\WMI\autologger\senseauditlogger + HKLM\SYSTEM\;Control\WMI\autologger\senseeventlog + HKLM\SYSTEM\;Control\WMI\EtwMaxLoggers + HKLM\SYSTEM\;Control\WMI\Security + + + + + + C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\aciseposture.exe + C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe + C:\Program Files\Cylance\Optics\CyOptics.exe + C:\Program Files\Cylance\Desktop\CylanceSvc.exe + Toolbar\WebBrowser + Toolbar\WebBrowser\ITBar7Height + Toolbar\ShellBrowser\ITBar7Layout + Internet Explorer\Toolbar\Locked + ShellBrowser + C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe + C:\Program Files\RES Software\Workspace Manager\pfwsmgr.exe + C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security + C:\Program Files\Kaspersky Lab\Kaspersky Internet Security + C:\Program Files\McAfee\Endpoint Encryption Agent\MfeEpeHost.exe + C:\Program Files\McAfee\Endpoint Security\Adaptive Threat Protection\mfeatp.exe + C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe + C:\Program Files\Common Files\McAfee\Engine\AMCoreUpdater\amupdate.exe + C:\Program Files\McAfee\Agent\masvc.exe + C:\Program Files\McAfee\Agent\x86\mfemactl.exe + C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe + C:\Program Files\McAfee\Agent\x86\macompatsvc.exe + C:\Program Files\McAfee\Endpoint Security\Threat Prevention\mfeensppl.exe + C:\Program Files\Common Files\McAfee\Engine\scanners + C:\Program Files\Common Files\McAfee\AVSolution\mcshield.exe + C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe + C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe + C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe + + C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe + HKLM\System\CurrentControlSet\Services\HealthService\Parameters\Management Groups + + C:\Program Files\ownCloud\owncloud.exe + C:\Program Files (x86)\ownCloud\owncloud.exe + + svchost.exe + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks + + C:\Program Files\SentinelOne\Sentinel Agent + System + + C:\Program Files\VMware\VMware Tools\vmtoolsd.exe + HKLM\System\CurrentControlSet\Services\Tcpip\Parameters + + C:\Program Files (x86)\Webroot\WRSA.exe + C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + \OpenWithProgids + \OpenWithList + \UserChoice + \UserChoice\ProgId + \UserChoice\Hash + \OpenWithList\MRUList + } 0xFFFF + Office\root\integration\integrator.exe + C:\WINDOWS\system32\backgroundTaskHost.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files\Windows Defender\MsMpEng.exe + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + C:\Program Files\Microsoft Application Virtualization\Client\AppVClient.exe + \CurrentVersion\App Paths + \CurrentVersion\Image File Execution Options + \CurrentVersion\Shell Extensions\Cached + \CurrentVersion\Shell Extensions\Approved + }\PreviousPolicyAreas + \Control\WMI\Autologger\ + HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start + \Lsa\OfflineJoin\CurrentValue + \Components\TrustedInstaller\Events + \Components\TrustedInstaller + \Components\Wlansvc + \Components\Wlansvc\Events + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ + \Directory\shellex + \Directory\shellex\DragDropHandlers + \Drive\shellex + \Drive\shellex\DragDropHandlers + _Classes\AppX + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ + SOFTWARE;\Microsoft\EnterpriseCertificates\Disallowed + SOFTWARE;\Microsoft\SystemCertificates\Disallowed + Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing + HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + C:\$WINDOWS.~BT\ + HKLM\System\CurrentControlSet\Services\Tcpip\Parameters + + C:\Windows\system32\lsass.exe + HKLM\System\CurrentControlSet\Services + + + SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization + C:\Windows\System32\svchost.exe + + HKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTime + HKLM\System\CurrentControlSet\Services\SmsRouter\State\Registration\Ids + \services\clr_optimization_v2.0.50727_32\Start + \services\clr_optimization_v2.0.50727_64\Start + \services\clr_optimization_v4.0.30319_32\Start + \services\clr_optimization_v4.0.30319_64\Start + \services\DeviceAssociationService\Start + \services\BITS\Start + \services\TrustedInstaller\Start + \services\tunnel\Start + \services\UsoSvc\Start + + + + + + Temp\7z + .bat + .cmd + Temp\debug.bin + .dll + .exe + .hta + + :Zone.Identifier + blob:;about:internet + + .lnk + Content.Outlook + .ps1 + .ps2 + .reg + Downloads + AppData + Temp + ProgramData + Users + .vb + .vbe + .vbs + + + + + + + \ + CreatePipe + + \atsvc + + \msse- + -server + + \msagent_ + \postex_ + \postex_ssh_ + \status_ + \gruntsvc + \svcctl + \msf-pipe + + \PSHost + powershell.exe + + + \PSHost + powershell_ise.exe + + \PSEXESVC + \srvsvc + + \TSVCPIPE + + \winreg + + + + + + + C:\Program Files;\Common Files\Adobe\ARM\1.0\AdobeARM.exe + \32B6B37A-4A7D-4e00-95F2- + thsnYaVieBoda + + + C:\Program Files;\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + \com.adobe.reader.rna.;\mojo + + + C:\Program Files;\Common Files\Adobe\AdobeGCClient\AGMService.exe + \gc_pipe_ + + + C:\Program Files;\Common Files\Adobe\Creative Cloud Libraries\libs\node.exe + \uv\ + + "C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" + + C:\Users\;\AppData\Local\Programs\Call Manager\Call Manager.exe + \crashpad_;\mojo.;\uv\ + + C:\Program Files;\Citrix\ICA Client\SelfServicePlugin\SelfService.exe + C:\Program Files;\Citrix\ICA Client\Receiver\Receiver.exe + C:\Program Files;\Citrix\ICA Client\wfcrun32.exe + C:\Program Files;\Citrix\ICA Client\concentr.exe + C:\Users\;\AppData\Local\Citrix\ICA Client\receiver\Receiver.exe + C:\Users\;\AppData\Local\Citrix\ICA Client\SelfServicePlugin\SelfService.exe + C:\Program Files;\FireEye\xagt\xagt.exe + + C:\Program Files;\Google\Update\Install\;setup.exe + \crashpad_ + + + C:\Program Files;\Google\Chrome\Application\chrome.exe + \mojo. + + + C:\Program Files;\Google\Chrome\Application\;\Installer\chrmstp.exe + \crashpad_ + + \Vivisimo Velocity + + C:\Program Files;\Microsoft\Edge\Application\msedge.exe + \LOCAL\mojo. + + + C:\Program Files;\Microsoft\Edge\Application\msedge.exe + \LOCAL\chrome.sync. + + + C:\Program Files;\Microsoft\Edge\Application\msedge.exe + \LOCAL\crashpad_ + + + C:\Program Files;\Microsoft Office\root\Office16\OUTLOOK.EXE + \MsFteWds + + + C:\Users\;\AppData\Local\Microsoft\Teams\current\Teams.exe + \mojo. + + + C:\Users\;\AppData\Local\Microsoft\Teams\current\Teams.exe + \chrome.sync. + + + C:\Program Files;\Mozilla Firefox\firefox.exe + \cubeb-pipe- + + + C:\Program Files;\Mozilla Firefox\firefox.exe + \chrome. + + + C:\Program Files;\Mozilla Firefox\firefox.exe + \gecko-crash-server-pipe. + + \SQLLocal\MSSQLSERVER + \SQLLocal\INSTANCE01 + \SQLLocal\SQLEXPRESS + \SQLLocal\COMMVAULT + \SQLLocal\RTCLOCAL + \SQLLocal\RTC + \SQLLocal\TMSM + Program Files (x86)\Microsoft SQL Server\110\DTS\binn\dtexec.exe + PostgreSQL\9.6\bin\postgres.exe + \pgsignal_ + Program Files\Qlik\Sense\Engine\Engine.exe + C:\Program Files;\Qualys\QualysAgent\QualysAgent.exe + Program Files\SplunkUniversalForwarder\bin\splunkd.exe + Program Files\SplunkUniversalForwarder\bin\splunk.exe + Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\CMAgent\OfcCMAgent.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\ofcservice.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Web\Service\DbServer.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\verconn.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WEB_OSCE\WEB\CGI\cgiOnClose.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WEB_OSCE\WEB\CGI\cgiRqHotFix.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\LWCS\LWCSService.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WSS\iCRCService.exe + Program Files\Trend\SPROTECT\x64\tsc.exe + Program Files\Trend\SPROTECT\x64\tsc64.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\osceintegrationservice.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\OfcLogReceiverSvc.exe + \Trend Micro OSCE Command Handler Manager + \Trend Micro OSCE Command Handler2 Manager + \Trend Micro Endpoint Encryption ToolBox Command Handler Manager + \OfcServerNamePipe + \ntapvsrq + \srvsvc + \wkssvc + \lsass + \winreg + \spoolss + Anonymous Pipe + c:\windows\system32\inetsrv\w3wp.exe + + + + + + Created + + + + + + + .1rx.io + .2mdn.net + .adadvisor.net + .adap.tv + .addthis.com + .adform.net + .adnxs.com + .adroll.com + .adrta.com + .adsafeprotected.com + .adsrvr.org + .advertising.com + .amazon-adsystem.com + .amazon-adsystem.com + .analytics.yahoo.com + .aol.com + .betrad.com + .bidswitch.net + .casalemedia.com + .chartbeat.net + .cnn.com + .convertro.com + .criteo.com + .criteo.net + .crwdcntrl.net + .demdex.net + .domdex.com + .dotomi.com + .doubleclick.net + .doubleverify.com + .emxdgt.com + .exelator.com + .google-analytics.com + .googleadservices.com + .googlesyndication.com + .googletagmanager.com + .googlevideo.com + .gstatic.com + .gvt1.com + .gvt2.com + .ib-ibi.com + .jivox.com + .mathtag.com + .moatads.com + .moatpixel.com + .mookie1.com + .myvisualiq.net + .netmng.com + .nexac.com + .openx.net + .optimizely.com + .outbrain.com + .pardot.com + .phx.gbl + .pinterest.com + .pubmatic.com + .quantcount.com + .quantserve.com + .revsci.net + .rfihub.net + .rlcdn.com + .rubiconproject.com + .scdn.co + .scorecardresearch.com + .serving-sys.com + .sharethrough.com + .simpli.fi + .sitescout.com + .smartadserver.com + .snapads.com + .spotxchange.com + .taboola.com + .taboola.map.fastly.net + .tapad.com + .tidaltv.com + .trafficmanager.net + .tremorhub.com + .tribalfusion.com + .turn.com + .twimg.com + .tynt.com + .w55c.net + .ytimg.com + .zorosrv.com + 1rx.io + adservice.google.com + ampcid.google.com + clientservices.googleapis.com + googleadapis.l.google.com + imasdk.googleapis.com + l.google.com + ml314.com + mtalk.google.com + update.googleapis.com + www.googletagservices.com + .mozaws.net + .mozilla.com + .mozilla.net + .mozilla.org + clients1.google.com + clients2.google.com + clients3.google.com + clients4.google.com + clients5.google.com + clients6.google.com + safebrowsing.googleapis.com + .akadns.net + .netflix.com + .aspnetcdn.com + ajax.googleapis.com + cdnjs.cloudflare.com + fonts.googleapis.com + .typekit.net + cdnjs.cloudflare.com + .stackassets.com + .steamcontent.com + .arpa. + .arpa + .msftncsi.com + .localmachine + localhost + + C:\ProgramData\LogiShrd\LogiOptions\Software\Current\updater.exe + .logitech.com + + C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe + -pushp.svc.ms + .b-msedge.net + .bing.com + .hotmail.com + .live.com + .live.net + .s-microsoft.com + .microsoft.com + .microsoftonline.com + .microsoftstore.com + .ms-acdc.office.com + .msedge.net + .msn.com + .msocdn.com + .skype.com + .skype.net + .windows.com + .windows.net.nsatc.net + .windowsupdate.com + .xboxlive.com + login.windows.net + outlook.office.com + statics.teams.cdn.office.net + acdc-direct.office.com + .fp.measure.office.com + office365.com + .activedirectory.windowsazure.com + .aria.microsoft.com + .msauth.net + .msftauth.net + .opinsights.azure.com + management.azure.com + outlook.office365.com + portal.azure.com + substrate.office.com + osi.office.net + .digicert.com + .globalsign.com + .globalsign.net + msocsp.com + ocsp.msocsp.com + pki.goog + .pki.goog + ocsp.godaddy.com + amazontrust.com + .amazontrust.com + ocsp.sectigo.com + pki-goog.l.google.com + .usertrust.com + ocsp.comodoca.com + ocsp.verisign.com + ocsp.entrust.net + ocsp.identrust.com + status.rapidssl.com + status.thawte.com + ocsp.int-x3.letsencrypt.org + subca.ocsp-certum.com + cscasha2.ocsp-certum.com + crl.verisign.com + C:\Program Files\SentinelOne\Sentinel Agent;\SentinelAgent.exe + .spotify.com + .spotify.map.fastly.net + C:\Windows\SystemApps\Microsoft.Windows.Search;SearchApp.exe + + + + + + + + True + C:\Windows\system32\cleanmgr.exe + .mui + + + .doc + .dot + .docx + .docm + .doc + .dot + .docx + .docm + .dotx + .dotm + .docb + .xls + .xlt + .xlm + .xlsx + .xlsm + .xltx + .xltm + .xlsb + .ppt + .pptx + .pptm + .potx + .potm + .odt + .ods + .odp + .pdf + .rtf + + + .aspx + .bat + .ps1 + .vbs + .vba + .hta + .jar + .js + .cmd + .sh + .sct + .lnk + + + .bin + .iso + .7z + .msi + .dmp + .reg + + + + + + + + + + + + C:\Program Files\Mozilla Firefox\firefox.exe + C:\Program Files\Mozilla Firefox\updater.exe + C:\Program Files\Mozilla Firefox\default-browser-agent.exe + C:\Program Files\Mozilla Firefox\pingsender.exe + C:\Program Files\Git\cmd\git.exe + C:\Program Files\Git\mingw64\bin\git.exe + C:\Program Files\Git\mingw64\libexec\git-core\git.exe + C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + + C:\Program Files (x86)\Microsoft\Edge\Application\ + \BHO\ie_to_edge_stub.exe + + + C:\Program Files (x86)\Microsoft\Edge\Application\ + \identity_helper.exe + + + C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\ + \MicrosoftEdge_X64_ + + C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin\XDelta64\xdelta3.exe + unknown process + C:\Program Files\Microsoft VS Code\Code.exe + C:\Windows\System32\wbem\WMIADAP.exe + + + + + + C:\Program Files\Microsoft SQL Server;\Shared\ErrorDumps + C:\Program Files\Microsoft SQL Server;\DataDumps + C:\Program Files (X86)\Microsoft SQL Server\;Shared\ErrorDumps + + C:\PS-Transcripts\;PowerShell_transcript + .txt + + + C:\Program Files\Qualys\QualysAgent + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + \Downloads\ + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + \Appdata\Local\Temp\ + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + \Appdata\Local\Microsoft\Windows\INetCache\Content.Outlook\ + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Intel + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Mozilla + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\chocolatey\logs + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\DeviceSync + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\PlayReady + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\User Account Pictures + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Office\Heartbeat + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\ReportQueue + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Intel + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Mozilla + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\chocolatey\logs + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\DeviceSync + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\PlayReady + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\User Account Pictures + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Crypto\DSS\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\NetFramework\BreadcrumbStore + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Office\Heartbeat + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Windows\WER\ReportArchive + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Windows\WER\ReportQueue + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\Tasks + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\tracing + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\Registration\CRMLog + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\System32\Tasks + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\System32\spool\drivers\color + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\SysWOW64\Tasks + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + + + + + \appdata\local\google\chrome\user data\swreporter\;software_reporter_tool.exe + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + NETWORK SERVICE; LOCAL SERVICE + + + + + C:\ + \\ + + + + + + C:\Windows\System32\svchost.exe + .tmp + + + + +