| ZeroBOX

WAT Fix.exe "C:\Users\test22\AppData\Local\Temp\WAT Fix.exe"
2552
- cmd.exe cmd.exe /A /C "taskkill /im hale.exe /f 2>NUL>NUL"
  2656
  - taskkill.exe taskkill /im hale.exe /f
    2700
- cmd.exe cmd.exe /A /C "attrib -r -a -s -h %SystemRoot%\system32\hale.exe 2>NUL>NUL"
  2828
  - attrib.exe attrib -r -a -s -h C:\Windows\system32\hale.exe
    2872
- cmd.exe cmd.exe /A /C "del /f %SystemRoot%\system32\hale.exe 2>NUL>NUL"
  2916
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\servicing\TrustedInstaller.exe"
  2960
  - takeown.exe takeown /f C:\Windows\servicing\TrustedInstaller.exe
    3004
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\servicing\TrustedInstaller.exe /grant *S-1-1-0:F"
  3052
  - icacls.exe icacls C:\Windows\servicing\TrustedInstaller.exe /grant *S-1-1-0:F
    2056
- cmd.exe cmd.exe /A /C "bcdedit.exe -set testsigning off 2>NUL>NUL"
  1728
  - bcdedit.exe bcdedit.exe -set testsigning off
    2136
- cmd.exe cmd.exe /A /C "sc config sppsvc start= delayed-auto 2>NUL>NUL"
  2188
  - sc.exe sc config sppsvc start= delayed-auto
    2252
- cmd.exe cmd.exe /A /C "sc config sppuinotify start= demand 2>NUL>NUL"
  2408
  - sc.exe sc config sppuinotify start= demand
    2520
- cmd.exe cmd.exe /A /C "net start sppsvc 2>NUL>NUL"
  2568
  - net.exe net start sppsvc
    2688
    - net1.exe C:\Windows\system32\net1 start sppsvc
      2632
- cmd.exe cmd.exe /A /C "net start sppuinotify 2>NUL>NUL"
  2752
  - net.exe net start sppuinotify
    2856
    - net1.exe C:\Windows\system32\net1 start sppuinotify
      2936
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\slmgr.vbs.removewat slmgr.vbs 2>NUL>NUL"
  3000
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\slmgr.vbs.removewat slmgr.vbs 2>NUL>NUL"
  2080
- cmd.exe cmd.exe /A /C "cscript.exe //nologo %SystemRoot%\system32\slmgr.vbs -rilc 2>NUL>NUL"
  2100
  - cscript.exe cscript.exe //nologo C:\Windows\system32\slmgr.vbs -rilc
    2064
- cmd.exe cmd.exe /A /C "sc stop uodin86 2>NUL>NUL"
  2956
  - sc.exe sc stop uodin86
    3032
- cmd.exe cmd.exe /A /C "sc delete uodin86 2>NUL>NUL"
  1152
  - sc.exe sc delete uodin86
    2744
- cmd.exe cmd.exe /A /C "sc stop uodin64 2>NUL>NUL"
  204
  - sc.exe sc stop uodin64
    1576
- cmd.exe cmd.exe /A /C "sc delete uodin64 2>NUL>NUL"
  1852
  - sc.exe sc delete uodin64
    2420
- cmd.exe cmd.exe /A /C "net stop sppsvc 2>NUL>NUL"
  1616
  - net.exe net stop sppsvc
    936
    - net1.exe C:\Windows\system32\net1 stop sppsvc
      2760
- cmd.exe cmd.exe /A /C "net stop sppuinotify 2>NUL>NUL"
  2972
  - net.exe net stop sppuinotify
    2920
    - net1.exe C:\Windows\system32\net1 stop sppuinotify
      452
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\drivers\uodin86.sys"
  1780
  - takeown.exe takeown /f C:\Windows\system32\drivers\uodin86.sys
    2580
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\drivers\uodin64.sys"
  2008
  - takeown.exe takeown /f C:\Windows\system32\drivers\uodin64.sys
    2012
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\drivers\uodin86.sys /grant *S-1-1-0:F"
  1120
  - icacls.exe icacls C:\Windows\system32\drivers\uodin86.sys /grant *S-1-1-0:F
    1560
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\drivers\uodin64.sys /grant *S-1-1-0:F"
  1520
  - icacls.exe icacls C:\Windows\system32\drivers\uodin64.sys /grant *S-1-1-0:F
    2636
- cmd.exe cmd.exe /A /C "del /f %SystemRoot%\system32\drivers\uodin86.sys 2>NUL>NUL"
  2776
- cmd.exe cmd.exe /A /C "del /f %SystemRoot%\system32\drivers\uodin64.sys 2>NUL>NUL"
  1920
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\slmgr.vbs"
  1512
  - takeown.exe takeown /f C:\Windows\SysWOW64\slmgr.vbs
    1364
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\slmgr.vbs /grant *S-1-1-0:F"
  176
  - icacls.exe icacls C:\Windows\SysWOW64\slmgr.vbs /grant *S-1-1-0:F
    916
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\slmgr.vbs slmgr.vbs.ngmvy"
  1376
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\user32.dll"
  3044
  - takeown.exe takeown /f C:\Windows\SysWOW64\user32.dll
    2216
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\user32.dll /grant *S-1-1-0:F"
  1668
  - icacls.exe icacls C:\Windows\SysWOW64\user32.dll /grant *S-1-1-0:F
    544
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\user32.dll user32.dll.ngmvy"
  3104
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\slwga.dll"
  3148
  - takeown.exe takeown /f C:\Windows\SysWOW64\slwga.dll
    3192
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\slwga.dll /grant *S-1-1-0:F"
  3240
  - icacls.exe icacls C:\Windows\SysWOW64\slwga.dll /grant *S-1-1-0:F
    3284
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\slwga.dll slwga.dll.ngmvy"
  3332
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\sppcomapi.dll"
  3400
  - takeown.exe takeown /f C:\Windows\SysWOW64\sppcomapi.dll
    3444
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\sppcomapi.dll /grant *S-1-1-0:F"
  3492
  - icacls.exe icacls C:\Windows\SysWOW64\sppcomapi.dll /grant *S-1-1-0:F
    3536
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\sppcomapi.dll sppcomapi.dll.ngmvy"
  3584
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\sppcommdlg.dll"
  3628
  - takeown.exe takeown /f C:\Windows\SysWOW64\sppcommdlg.dll
    3672
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\sppcommdlg.dll /grant *S-1-1-0:F"
  3720
  - icacls.exe icacls C:\Windows\SysWOW64\sppcommdlg.dll /grant *S-1-1-0:F
    3764
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\sppcommdlg.dll sppcommdlg.dll.ngmvy"
  3812
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\sppuinotify.dll"
  3856
  - takeown.exe takeown /f C:\Windows\SysWOW64\sppuinotify.dll
    3900
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\sppuinotify.dll /grant *S-1-1-0:F"
  3948
  - icacls.exe icacls C:\Windows\SysWOW64\sppuinotify.dll /grant *S-1-1-0:F
    3992
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\sppuinotify.dll sppuinotify.dll.ngmvy"
  4040
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\sppwmi.dll"
  4084
  - takeown.exe takeown /f C:\Windows\SysWOW64\sppwmi.dll
    1848
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\sppwmi.dll /grant *S-1-1-0:F"
  3180
  - icacls.exe icacls C:\Windows\SysWOW64\sppwmi.dll /grant *S-1-1-0:F
    3232
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\sppwmi.dll sppwmi.dll.ngmvy"
  3316
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\systemcpl.dll"
  3360
  - takeown.exe takeown /f C:\Windows\SysWOW64\systemcpl.dll
    3432
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\systemcpl.dll /grant *S-1-1-0:F"
  3512
  - icacls.exe icacls C:\Windows\SysWOW64\systemcpl.dll /grant *S-1-1-0:F
    3576
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\systemcpl.dll systemcpl.dll.ngmvy"
  3640
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\winlogon.exe"
  3676
  - takeown.exe takeown /f C:\Windows\SysWOW64\winlogon.exe
    3796
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\winlogon.exe /grant *S-1-1-0:F"
  3852
  - icacls.exe icacls C:\Windows\SysWOW64\winlogon.exe /grant *S-1-1-0:F
    3928
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\winlogon.exe winlogon.exe.ngmvy"
  4012
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\winver.exe"
  4052
  - takeown.exe takeown /f C:\Windows\SysWOW64\winver.exe
    2084
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\winver.exe /grant *S-1-1-0:F"
  3272
  - icacls.exe icacls C:\Windows\SysWOW64\winver.exe /grant *S-1-1-0:F
    3364
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\winver.exe winver.exe.ngmvy"
  3404
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\slui.exe"
  3496
  - takeown.exe takeown /f C:\Windows\SysWOW64\slui.exe
    3660
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\slui.exe /grant *S-1-1-0:F"
  3804
  - icacls.exe icacls C:\Windows\SysWOW64\slui.exe /grant *S-1-1-0:F
    3916
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\slui.exe slui.exe.ngmvy"
  4036
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\ntkrnlpa.exe"
  2168
  - takeown.exe takeown /f C:\Windows\SysWOW64\ntkrnlpa.exe
    3456
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\ntkrnlpa.exe /grant *S-1-1-0:F"
  3440
  - icacls.exe icacls C:\Windows\SysWOW64\ntkrnlpa.exe /grant *S-1-1-0:F
    3760
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\ntkrnlpa.exe ntkrnlpa.exe.ngmvy"
  3968
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\ntoskrnl.exe"
  4080
  - takeown.exe takeown /f C:\Windows\SysWOW64\ntoskrnl.exe
    3312
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\ntoskrnl.exe /grant *S-1-1-0:F"
  3712
  - icacls.exe icacls C:\Windows\SysWOW64\ntoskrnl.exe /grant *S-1-1-0:F
    3932
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\SysWOW64\ntoskrnl.exe ntoskrnl.exe.ngmvy"
  3524
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\SysWOW64\Wat\*"
  3844
  - takeown.exe takeown /f C:\Windows\SysWOW64\Wat\*
    3920
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\SysWOW64\Wat\* /grant *S-1-1-0:F"
  3860
  - icacls.exe icacls C:\Windows\SysWOW64\Wat\* /grant *S-1-1-0:F
    3208
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\slmgr.vbs"
  3168
  - takeown.exe takeown /f C:\Windows\system32\slmgr.vbs
    740
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\slmgr.vbs /grant *S-1-1-0:F"
  4136
  - icacls.exe icacls C:\Windows\system32\slmgr.vbs /grant *S-1-1-0:F
    4180
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\slmgr.vbs slmgr.vbs.ngmvy"
  4228
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\user32.dll"
  4272
  - takeown.exe takeown /f C:\Windows\system32\user32.dll
    4316
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\user32.dll /grant *S-1-1-0:F"
  4388
  - icacls.exe icacls C:\Windows\system32\user32.dll /grant *S-1-1-0:F
    4436
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\user32.dll user32.dll.ngmvy"
  4544
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\slwga.dll"
  4636
  - takeown.exe takeown /f C:\Windows\system32\slwga.dll
    4696
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\slwga.dll /grant *S-1-1-0:F"
  4784
  - icacls.exe icacls C:\Windows\system32\slwga.dll /grant *S-1-1-0:F
    4828
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\slwga.dll slwga.dll.ngmvy"
  4888
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\sppcomapi.dll"
  4932
  - takeown.exe takeown /f C:\Windows\system32\sppcomapi.dll
    4980
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\sppcomapi.dll /grant *S-1-1-0:F"
  5032
  - icacls.exe icacls C:\Windows\system32\sppcomapi.dll /grant *S-1-1-0:F
    5076
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\sppcomapi.dll sppcomapi.dll.ngmvy"
  4108
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\sppcommdlg.dll"
  4148
  - takeown.exe takeown /f C:\Windows\system32\sppcommdlg.dll
    4220
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\sppcommdlg.dll /grant *S-1-1-0:F"
  4288
  - icacls.exe icacls C:\Windows\system32\sppcommdlg.dll /grant *S-1-1-0:F
    4384
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\sppcommdlg.dll sppcommdlg.dll.ngmvy"
  4448
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\sppuinotify.dll"
  4520
  - takeown.exe takeown /f C:\Windows\system32\sppuinotify.dll
    4632
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\sppuinotify.dll /grant *S-1-1-0:F"
  4668
  - icacls.exe icacls C:\Windows\system32\sppuinotify.dll /grant *S-1-1-0:F
    1708
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\sppuinotify.dll sppuinotify.dll.ngmvy"
  4860
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\sppwmi.dll"
  4916
  - takeown.exe takeown /f C:\Windows\system32\sppwmi.dll
    5012
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\sppwmi.dll /grant *S-1-1-0:F"
  5044
  - icacls.exe icacls C:\Windows\system32\sppwmi.dll /grant *S-1-1-0:F
    2344
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\sppwmi.dll sppwmi.dll.ngmvy"
  3348
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\systemcpl.dll"
  1040
  - takeown.exe takeown /f C:\Windows\system32\systemcpl.dll
    4168
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\systemcpl.dll /grant *S-1-1-0:F"
  2652
  - icacls.exe icacls C:\Windows\system32\systemcpl.dll /grant *S-1-1-0:F
    4392
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\systemcpl.dll systemcpl.dll.ngmvy"
  4548
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\winlogon.exe"
  1832
  - takeown.exe takeown /f C:\Windows\system32\winlogon.exe
    4880
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\winlogon.exe /grant *S-1-1-0:F"
  5024
  - icacls.exe icacls C:\Windows\system32\winlogon.exe /grant *S-1-1-0:F
    5088
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\winlogon.exe winlogon.exe.ngmvy"
  4128
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\winver.exe"
  4156
  - takeown.exe takeown /f C:\Windows\system32\winver.exe
    4336
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\winver.exe /grant *S-1-1-0:F"
  4516
  - icacls.exe icacls C:\Windows\system32\winver.exe /grant *S-1-1-0:F
    1868
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\winver.exe winver.exe.ngmvy"
  4756
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\slui.exe"
  4952
  - takeown.exe takeown /f C:\Windows\system32\slui.exe
    1172
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\slui.exe /grant *S-1-1-0:F"
  5064
  - icacls.exe icacls C:\Windows\system32\slui.exe /grant *S-1-1-0:F
    252
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\ntkrnlpa.exe"
  4728
  - takeown.exe takeown /f C:\Windows\system32\ntkrnlpa.exe
    4672
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\ntkrnlpa.exe /grant *S-1-1-0:F"
  5028
  - icacls.exe icacls C:\Windows\system32\ntkrnlpa.exe /grant *S-1-1-0:F
    4224
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\ntkrnlpa.exe ntkrnlpa.exe.ngmvy"
  4416
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\ntoskrnl.exe"
  5108
  - takeown.exe takeown /f C:\Windows\system32\ntoskrnl.exe
    4260
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\ntoskrnl.exe /grant *S-1-1-0:F"
  4464
  - icacls.exe icacls C:\Windows\system32\ntoskrnl.exe /grant *S-1-1-0:F
    4656
- cmd.exe cmd.exe /A /C "ren %SystemRoot%\system32\ntoskrnl.exe ntoskrnl.exe.ngmvy"
  4512
- cmd.exe cmd.exe /A /C "takeown /f %SystemRoot%\system32\Wat\*"
  1872
  - takeown.exe takeown /f C:\Windows\system32\Wat\*
    2128
- cmd.exe cmd.exe /A /C "icacls %SystemRoot%\system32\Wat\* /grant *S-1-1-0:F"
  4348
  - icacls.exe icacls C:\Windows\system32\Wat\* /grant *S-1-1-0:F
    5124
- cmd.exe cmd.exe /A /C "rmdir /s /q %ALLUSERSPROFILE%\Microsoft\Windows\RAI 2>NUL>NUL"
  5196
- cmd.exe cmd.exe /A /C "rmdir /s /q %ALLUSERSPROFILE%\Microsoft\Windows\SXS 2>NUL>NUL"
  5240
- cmd.exe cmd.exe /A /C "reg delete HKLM\SOFTWARE\HAL7600 /f 2>NUL>NUL"
  5284
  - reg.exe reg delete HKLM\SOFTWARE\HAL7600 /f
    5328
- cmd.exe cmd.exe /A /C "reg delete HKLM\SOFTWARE\Chew7 /f 2>NUL>NUL"
  5372
  - reg.exe reg delete HKLM\SOFTWARE\Chew7 /f
    5416
- cmd.exe cmd.exe /A /C "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Chew7Hale /f 2>NUL>NUL"
  5460
  - reg.exe reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Chew7Hale /f
    5504
- cmd.exe cmd.exe /A /C "schtasks.exe /delete /tn \Microsoft\Windows\RAI\RaiTask /f 2>NUL>NUL"
  5548
  - schtasks.exe schtasks.exe /delete /tn \Microsoft\Windows\RAI\RaiTask /f
    5592
- cmd.exe cmd.exe /A /C "schtasks.exe /delete /tn \Microsoft\Windows\PMS\ResetDTL /f 2>NUL>NUL"
  5640
  - schtasks.exe schtasks.exe /delete /tn \Microsoft\Windows\PMS\ResetDTL /f
    5684
- cmd.exe cmd.exe /A /C "NET START "Windows Modules Installer" 2>NUL>NUL"
  5732
  - net.exe NET START "Windows Modules Installer"
    5776
    - net1.exe C:\Windows\system32\net1 START "Windows Modules Installer"
      5820
- sfc.exe /scanfile=C:\Windows\SysWOW64\slmgr.vbs
  5900
- sfc.exe /scanfile=C:\Windows\System32\slmgr.vbs
  5980
- sfc.exe /scanfile=C:\Windows\SysWOW64\user32.dll
  6080
- sfc.exe /scanfile=C:\Windows\System32\user32.dll
  5156
- sfc.exe /scanfile=C:\Windows\SysWOW64\slwga.dll
  5256
- sfc.exe /scanfile=C:\Windows\System32\slwga.dll
  5324
- sfc.exe /scanfile=C:\Windows\SysWOW64\sppcomapi.dll
  5492
- sfc.exe /scanfile=C:\Windows\System32\sppcomapi.dll
  5624
- sfc.exe /scanfile=C:\Windows\SysWOW64\sppcommdlg.dll
  5688
- sfc.exe /scanfile=C:\Windows\System32\sppcommdlg.dll
  5892
- sfc.exe /scanfile=C:\Windows\SysWOW64\sppuinotify.dll
  5952
- sfc.exe /scanfile=C:\Windows\System32\sppuinotify.dll
  6024
- sfc.exe /scanfile=C:\Windows\SysWOW64\sppwmi.dll
  5168
- sfc.exe /scanfile=C:\Windows\System32\sppwmi.dll
  5340
- sfc.exe /scanfile=C:\Windows\SysWOW64\systemcpl.dll
  5436
- sfc.exe /scanfile=C:\Windows\System32\systemcpl.dll
  5656
- sfc.exe /scanfile=C:\Windows\SysWOW64\winlogon.exe
  5884
- sfc.exe /scanfile=C:\Windows\System32\winlogon.exe
  5976
- sfc.exe /scanfile=C:\Windows\SysWOW64\winver.exe
  6096
- sfc.exe /scanfile=C:\Windows\System32\winver.exe
  5228
- sfc.exe /scanfile=C:\Windows\SysWOW64\slui.exe
  5288
- sfc.exe /scanfile=C:\Windows\System32\slui.exe
  5500
- sfc.exe /scannow
  5748

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents