{"id":8443,"date":"2023-03-12T00:03:36","date_gmt":"2023-03-12T00:03:36","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=8443"},"modified":"2023-03-12T00:03:36","modified_gmt":"2023-03-12T00:03:36","slug":"list-of-clean-mutexes-and-mutants","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2023\/03\/12\/list-of-clean-mutexes-and-mutants\/","title":{"rendered":"List of clean mutexes and mutants"},"content":{"rendered":"\n<p>A few years ago I <a href=\"https:\/\/www.hexacorn.com\/blog\/2014\/12\/23\/santas-bag-full-of-mutants\/\" data-type=\"post\">released<\/a> a list of &#8216;bad&#8217; mutexes\/mutants. That list was generated from my <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/07\/17\/logs-from-1-6m-sandboxed-samples-release\/\" data-type=\"post\" data-id=\"6556\">malware sandbox reports<\/a>. <\/p>\n\n\n\n<p>I thought that it may be good to revisit the idea, but this time with a focus on a &#8216;clean&#8217; list. <\/p>\n\n\n\n<p>What do I mean by that?<\/p>\n\n\n\n<p>Windows native binaries reference many &#8216;clean&#8217; mutexes and mutants. By looking for references to CreateMutex* and OpenMutex API invocations inside the native OS applications and DLLs we can build a list presented below. <\/p>\n\n\n\n<p>I hope you will agree that amongst all the items presented, the <em>x9pv45dxghk<\/em> mutex looks the most suspicious, as if malware just hit your system, but &#8230; it&#8217;s actually not a bad guy! Also, some of these mutexes you will probably never see in your logs f.ex. anything <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/rras\/about-remote-access-service\">RAS<\/a>-related is kinda dead, because dialers are long gone (of course, RAS is a bit wider in scope, but you know what I mean). But then some of them may actually still be helpful in detecting interesting OS events f.ex. everything with a &#8216;RDP&#8217; in name. There are also some eye-catching mutexes that may be worth further exploration, f.ex. <em>Global\\SignedDriversMutex<\/em> is created before <em>driverquery.exe<\/em> runs a WQL query &#8220;<em>select * from Win32_PnpSignedDriver where DeviceName != NULL<\/em>&#8220;. Why that mutex is needed there? Hmm&#8230;<\/p>\n\n\n\n<p>Let&#8217;s remember that mutexes often guard program&#8217;s important business logic. By understanding why these mutexes are created we may affect some of this logic and take over the program&#8217;s narrative. For example, the <em>WerMgr.exe<\/em> uses <em>Global\\WerMgrUploadingLock<\/em> mutex to ensure only one instance of <em>WerMgr.exe<\/em> is uploading Windows Error Reports (for wemgr.exe options &#8211;<em>upload<\/em> and &#8211;<em>uploadforce<\/em>). It&#8217;s not very useful per se, but it makes the point.<\/p>\n\n\n\n<p>Here&#8217;s the list I collected:<\/p>\n\n\n\n<p><strong>2F8FA37B-8158-476F-9B22-3283D2A6FEC2<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\phoneactivate.exe<\/li><\/ul>\n\n\n\n<p><strong>5615046C-3289-4BC3-A5C7-0E9B0FE4C2DA<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\CourtesyEngine.dll<\/li><\/ul>\n\n\n\n<p><strong>ACTIONDIALOG_MUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\WindowsActionDialog.exe<\/li><\/ul>\n\n\n\n<p><strong>AD8DA490-28A3-4dfd-96BA-37453388BAEF<\/strong><\/p>\n\n\n\n<ul><li>Program Files (x86)\\Windows Photo Viewer\\PhotoAcq.dll<\/li><li>Program Files\\Windows Photo Viewer\\PhotoAcq.dll<\/li><\/ul>\n\n\n\n<p><strong>AMResourceMutex3<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\quartz.dll<\/li><li>Windows\\System32\\quartz.dll<\/li><\/ul>\n\n\n\n<p><strong>AccessibilitySoundAgentRunning<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\PlaySndSrv.dll<\/li><li>Windows\\SysWOW64\\sethc.exe<\/li><li>Windows\\System32\\PlaySndSrv.dll<\/li><li>Windows\\System32\\sethc.exe<\/li><\/ul>\n\n\n\n<p><strong>AppIDSvc\\CertStore<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\appidcertstorecheck.exe<\/li><\/ul>\n\n\n\n<p><strong>AppIDSvc\\PolicyMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\appidpolicyconverter.exe<\/li><\/ul>\n\n\n\n<p><strong>AssignedAccessCspDataStore{2DB91A08-F99F-4E50-A831-6D917523A264}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\AssignedAccessCsp.dll<\/li><\/ul>\n\n\n\n<p><strong>AuthHostAppContainerMutex.SSO<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\AuthBroker.dll<\/li><li>Windows\\System32\\AuthBroker.dll<\/li><\/ul>\n\n\n\n<p><strong>AutoTune<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\psisdecd.dll<\/li><li>Windows\\System32\\psisdecd.dll<\/li><\/ul>\n\n\n\n<p><strong>BDATIF_Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\psisdecd.dll<\/li><li>Windows\\System32\\psisdecd.dll<\/li><\/ul>\n\n\n\n<p><strong>BFFF9080-1DAE-43B1-96B6-738575D01524<\/strong><\/p>\n\n\n\n<ul><li>Program Files (x86)\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll<\/li><li>Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe<\/li><li>Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll<\/li><li>Windows\\System32\\msTextPrediction.dll<\/li><\/ul>\n\n\n\n<p><strong>CB35EF5D-4591-41d9-BBA2-0363342F3783<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\cscsvc.dll<\/li><\/ul>\n\n\n\n<p><strong>CSM Policy Key Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\SearchIndexer.exe<\/li><li>Windows\\SysWOW64\\srchadmin.dll<\/li><li>Windows\\System32\\SearchIndexer.exe<\/li><li>Windows\\System32\\srchadmin.dll<\/li><\/ul>\n\n\n\n<p><strong>CWpcTridentWebFilter::Initialize<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\WpcWebFilter.dll<\/li><li>Windows\\System32\\WpcWebFilter.dll<\/li><\/ul>\n\n\n\n<p><strong>ClearTypeTunerWizardMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\cttune.exe<\/li><li>Windows\\System32\\cttune.exe<\/li><\/ul>\n\n\n\n<p><strong>CloudNotifications<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\CloudNotifications.exe<\/li><li>Windows\\System32\\CloudNotifications.exe<\/li><\/ul>\n\n\n\n<p><strong>Connection Manager Phonebook Access<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\cmdl32.exe<\/li><li>Windows\\System32\\cmdl32.exe<\/li><\/ul>\n\n\n\n<p><strong>Connection Manager Profile Installer Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\cmstp.exe<\/li><li>Windows\\System32\\cmstp.exe<\/li><\/ul>\n\n\n\n<p><strong>CredPicker.Mutex_CAED75DD_5855_49C7_A2FD_4CC470A3575E<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\Windows.Security.Credentials.UI.CredentialPicker.dll<\/li><\/ul>\n\n\n\n<p><strong>DBWinMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\KernelBase.dll<\/li><li>Windows\\System32\\KernelBase.dll<\/li><\/ul>\n\n\n\n<p><strong>DSKQUOTA_SIDCACHE_MUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\dskquota.dll<\/li><li>Windows\\System32\\dskquota.dll<\/li><\/ul>\n\n\n\n<p><strong>DirectMusiCPcClockMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\dmusic.dll<\/li><li>Windows\\System32\\dmusic.dll<\/li><\/ul>\n\n\n\n<p><strong>DirectMusicMasterClockMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\dmusic.dll<\/li><li>Windows\\System32\\dmusic.dll<\/li><\/ul>\n\n\n\n<p><strong>DiskSnapshot-Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\DiskSnapshot.exe<\/li><\/ul>\n\n\n\n<p><strong>DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\drvinst.exe<\/li><li>Windows\\System32\\pnppolicy.dll<\/li><\/ul>\n\n\n\n<p><strong>EUPPSYNCLOCK<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\msfeeds.dll<\/li><li>Windows\\System32\\msfeeds.dll<\/li><\/ul>\n\n\n\n<p><strong>EduPrintProvSingleInstance<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\EduPrintProv.exe<\/li><\/ul>\n\n\n\n<p><strong>EnterpriseIDMutex-61982412-20ce-4a9a-b974-55c3ce44b9b0<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\efswrt.dll<\/li><li>Windows\\System32\\efswrt.dll<\/li><\/ul>\n\n\n\n<p><strong>FinishInstallOperation_mutex_{13f20490-1533-411a-9489-1a6da95d2b85}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\newdev.dll<\/li><li>Windows\\System32\\newdev.dll<\/li><\/ul>\n\n\n\n<p><strong>FlightActionManagerConsolidateMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\FlightSettings.dll<\/li><li>Windows\\System32\\FlightSettings.dll<\/li><\/ul>\n\n\n\n<p><strong>GeneratingSchemaGlobalMapping<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\propsys.dll<\/li><li>Windows\\System32\\propsys.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\552FFA80-3393-423d-8671-7BA046BB5906<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\sppc.dll<\/li><li>Windows\\System32\\sppc.dll<\/li><li>Windows\\System32\\sppsvc.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\AudioResourceAcquisitionMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\audioresourceregistrar.dll<\/li><li>Windows\\System32\\audiosrv.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\CDNDownloadMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\dmenrollengine.dll<\/li><li>Windows\\System32\\DeviceEnroller.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\ComPortNumberDatabaseMutexObject<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\msports.dll<\/li><li>Windows\\System32\\msports.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\DFXLIB_STORE_MUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\difxapi.dll<\/li><li>Windows\\System32\\difxapi.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\DVD_Region_Cntry_List_Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\Storprop.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\DeclaredConfigurationMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\dmenrollengine.dll<\/li><li>Windows\\System32\\omadmclient.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\DeviceManagementContainerMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\dmcmnutils.dll<\/li><li>Windows\\System32\\dmcmnutils.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\F659A567-8ACB-4E4A-92A7-5C2DD1884F72<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\RacEngn.dll<\/li><li>Windows\\System32\\RacEngn.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\FillWindowsUpdatePrinterCatalog<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\ntprint.dll<\/li><li>Windows\\System32\\ntprint.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\FindNetPrinters{60E245A9-955D-421b-985C-A48F7CBF0476}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\findnetprinters.dll<\/li><li>Windows\\System32\\findnetprinters.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\Fve-AAD-Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\fveskybackup.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\LicenseUI<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\LicensingUI.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\Lpksetup-TempFolderToken<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\lpksetup.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\MS ODBC PerfMon<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\odbc32.dll<\/li><li>Windows\\System32\\odbc32.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\Microsoft.Windows.Setup.Box<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\UpdateAgent.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\Microsoft.Windows.Setup.SetupCln<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\setupcln.dll<\/li><li>Windows\\System32\\setupcln.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\Microsoft.Windows.WindowsColorSystem.CalibrationLoaderMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\mscms.dll<\/li><li>Windows\\System32\\mscms.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\NetSetupShimDriverInstallUninstall<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\NetSetupShim.dll<\/li><li>Windows\\System32\\NetSetupShim.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\PolicyManagerMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\Win32AppSettingsProvider.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\RasMpDevices<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\mprdim.dll<\/li><li>Windows\\System32\\mprdim.dll<\/li><li>Windows\\System32\\rasmans.dll<\/li><li>Windows\\System32\\sstpsvc.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\RasPbFile<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\rasplap.dll<\/li><li>Windows\\System32\\rasapi32.dll<\/li><li>Windows\\System32\\rasdlg.dll<\/li><li>Windows\\System32\\rasgcw.dll<\/li><li>Windows\\System32\\rasmans.dll<\/li><li>Windows\\System32\\rasplap.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\RecentDocumentsUpdate<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\windows.storage.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\SQMWindowsConsolidator<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\wsqmcons.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\ServicePackOrHotfix<\/strong><\/p>\n\n\n\n<ul><li>Program Files (x86)\\Windows Media Player\\setup_wm.exe<\/li><li>Program Files\\Windows Media Player\\setup_wm.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\SetupLog<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\wimgapi.dll<\/li><li>Windows\\System32\\wimgapi.dll<\/li><li>Windows\\System32\\wimserv.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\SignedDriversMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\driverquery.exe<\/li><li>Windows\\System32\\driverquery.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\SpaceWorker_Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\SpaceAgent.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\TPAC_DEBUG_FILE_ACCESS<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\TPSvc.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\WAU running<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\LicensingWinRT.dll<\/li><li>Windows\\System32\\LicensingWinRT.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\WDC.0AF0EEEF-BDEC-4D4C-AC72-6AF58B3EEE01<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\wdc.dll<\/li><li>Windows\\System32\\wdc.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\WIATRACE_MUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\sti.dll<\/li><li>Windows\\SysWOW64\\wiaaut.dll<\/li><li>Windows\\System32\\sti.dll<\/li><li>Windows\\System32\\sti_ci.dll<\/li><li>Windows\\System32\\wiaaut.dll<\/li><li>Windows\\System32\\wiarpc.dll<\/li><li>Windows\\System32\\wiaservc.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\WerKernelVerticalConvertingLiveDump<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\WerFault.exe<\/li><li>Windows\\System32\\WerFault.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\WerKernelVerticalGeneratingDump<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\WerFault.exe<\/li><li>Windows\\System32\\WerFault.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\WerKernelVerticalReporting<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\WerFault.exe<\/li><li>Windows\\System32\\WerFault.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\WerMgrUploadingLock<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\wermgr.exe<\/li><li>Windows\\System32\\wermgr.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\WinSATMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\WinSAT.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\Windows.User.OOBE<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\explorer.exe<\/li><li>Windows\\SysWOW64\\twinui.dll<\/li><li>Windows\\System32\\twinui.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\lpksetup-init<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\lpksetup.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\mbaeapi.mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\MbaeApi.dll<\/li><li>Windows\\System32\\MbaeApi.dll<\/li><\/ul>\n\n\n\n<p><strong>Global\\{5E5C36C0-5E7C-471f-84D7-110FDC1AFD0D}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\esent.dll<\/li><li>Windows\\System32\\esent.dll<\/li><li>Windows\\System32\\esentutl.exe<\/li><\/ul>\n\n\n\n<p><strong>Global\\{B817B57E-5013-4b35-BD74-24B3C225ED6E}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\dstokenclean.exe<\/li><\/ul>\n\n\n\n<p><strong>IESettingSyncMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\IESettingSync.exe<\/li><\/ul>\n\n\n\n<p><strong>KeyMgrMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\keymgr.dll<\/li><li>Windows\\System32\\keymgr.dll<\/li><\/ul>\n\n\n\n<p><strong>LOCATIONNOTIFICATION_MUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\LocationNotificationWindows.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\!BrowserEmulation!SharedMemory!Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\urlmon.dll<\/li><li>Windows\\System32\\urlmon.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\BitLockerChangePinTaskDialogMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\bdechangepin.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\C9E8AF12-FA27-4748-EC04-38CA71239739_RegisterDevice<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\DeviceDirectoryClient.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\Color CPL Startup Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\colorui.dll<\/li><li>Windows\\System32\\colorui.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\CscUnpinSingletonProcess<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\Microsoft.Uev.CscUnpinTool.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\DCCW Startup Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\dccw.exe<\/li><li>Windows\\System32\\dccw.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\DDrawDriverObjectListMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\ddraw.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\DDrawWindowListMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\ddraw.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\DSREGCMD-Recovery<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\dsreg.dll<\/li><li>Windows\\System32\\dsreg.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\DialersIveBeenStartedMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\dialer.exe<\/li><li>Windows\\System32\\dialer.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\E2A05719-7EDD-4269-94FB-E5C725AE176B<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\Windows.Cortana.Desktop.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\ERCAPPSINGLEINSTANCE<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\werconcpl.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\ExplorerIsShellMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\explorer.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\Feeds Store Mutex LoRIE<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\msfeeds.dll<\/li><li>Windows\\System32\\msfeeds.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\FmsRegChangeMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\fms.dll<\/li><li>Windows\\System32\\fms.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\FmsRegMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\fms.dll<\/li><li>Windows\\System32\\fms.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\HelpPaneRunningMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\HelpPane.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\InputServiceHostMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\MsCtfMonitor.dll<\/li><li>Windows\\System32\\MsCtfMonitor.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\LRIEElevationPolicyMutex<\/strong><\/p>\n\n\n\n<ul><li>Program Files (x86)\\Internet Explorer\\IEShims.dll<\/li><li>Program Files\\Internet Explorer\\IEShims.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\LockAppHostThreadProcMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\LockHostingFramework.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\MICROSOFT_WMDM_MUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\mswmdm.dll<\/li><li>Windows\\System32\\mswmdm.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\MPSWabDataAccessMutex<\/strong><\/p>\n\n\n\n<ul><li>Program Files (x86)\\Common Files\\System\\wab32.dll<\/li><li>Program Files\\Common Files\\System\\wab32.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\MSIdent Logon<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\msident.dll<\/li><li>Windows\\System32\\msident.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\Microsoft-Windows-LockScreenHistory<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\Windows.UI.Immersive.dll<\/li><li>Windows\\System32\\Windows.UI.Immersive.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\Microsoft:VisionTools:GlobalsMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\MSPhotography.dll<\/li><li>Windows\\SysWOW64\\MSVideoDSP.dll<\/li><li>Windows\\System32\\MSPhotography.dll<\/li><li>Windows\\System32\\MSVideoDSP.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\Microsoft_WMP_70_CheckForOtherInstanceMutex<\/strong><\/p>\n\n\n\n<ul><li>Program Files (x86)\\Windows Media Player\\wmplayer.exe<\/li><li>Program Files\\Windows Media Player\\wmplayer.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\MidiMapper_modLongMessage_RefCnt<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\midimap.dll<\/li><li>Windows\\System32\\midimap.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\RdpInitMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\rdpinit.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\RdpInitSxSMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\rdpinit.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\RdpShellMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\rdpshell.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\RemoteAssistanceNoviceLock<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\msra.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\RemoteAssistanceSettingLockS<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\msra.exe<\/li><li>Windows\\System32\\msrahc.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\SessionImmersiveColorMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\explorer.exe<\/li><li>Windows\\SysWOW64\\uxtheme.dll<\/li><li>Windows\\System32\\uxtheme.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\Shell.CMruPidlList<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\windows.storage.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\Shell_LightDismissOverlay_Sync<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\Windows.UI.Immersive.dll<\/li><li>Windows\\System32\\Windows.UI.Immersive.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\SpeechUX~Running<\/strong><\/p>\n\n\n\n<ul><li>Windows\\IME\\SPTIP.DLL<\/li><\/ul>\n\n\n\n<p><strong>Local\\SyncCenterAllowIsolationServer<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\SyncCenter.dll<\/li><li>Windows\\System32\\SyncCenter.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\SyncServiceThread<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\SyncCenter.dll<\/li><li>Windows\\System32\\SyncCenter.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\SystemResetExeAlreadyRunning<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\systemreset.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\TpmInit<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\TpmInit.exe<\/li><li>Windows\\System32\\TpmInit.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\WMDMLogger.LogFile.Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\wmdmlog.dll<\/li><li>Windows\\System32\\wmdmlog.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\WMDMLogger.Registry.Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\wmdmlog.dll<\/li><li>Windows\\System32\\wmdmlog.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\WindowsSearchService_EfsRegKeysMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\mssrch.dll<\/li><li>Windows\\System32\\mssrch.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\ZonesCacheCounterMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\urlmon.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\ZonesLockedCacheCounterMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\urlmon.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\__DDrawCheckExclMode__<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\ddraw.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\__DDrawExclMode__<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\d3d8.dll<\/li><li>Windows\\SysWOW64\\d3d9.dll<\/li><li>Windows\\SysWOW64\\ddraw.dll<\/li><li>Windows\\System32\\d3d9.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\ba76e584-735b-45d5-ab75-7ecb8ec8f208<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\rekeywiz.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\tapi_dp_mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\tapi32.dll<\/li><li>Windows\\System32\\tapi32.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\workspace_status_notifier<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\TSWorkspace.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\{62D41444-0649-48E1-9670-1E54E5B06001}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\themecpl.dll<\/li><li>Windows\\System32\\themecpl.dll<\/li><\/ul>\n\n\n\n<p><strong>Local\\{9ea26f7c-c1a5-466d-9c5e-0be4435f9910}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\Dxpserver.exe<\/li><\/ul>\n\n\n\n<p><strong>Local\\{EA35C8AC-BCAE-4458-98BD-F3ECB90DBC09}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\psr.exe<\/li><li>Windows\\System32\\psr.exe<\/li><\/ul>\n\n\n\n<p><strong>LockScreenDataLayerMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\LockAppBroker.dll<\/li><li>Windows\\System32\\LockAppBroker.dll<\/li><\/ul>\n\n\n\n<p><strong>MCICDA_InitCritSection<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\mcicda.dll<\/li><li>Windows\\System32\\mcicda.dll<\/li><\/ul>\n\n\n\n<p><strong>MOBILITYCENTER_MUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\mblctr.exe<\/li><\/ul>\n\n\n\n<p><strong>MSDevicePairingWizard<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\DevicePairing.dll<\/li><li>Windows\\System32\\DevicePairing.dll<\/li><\/ul>\n\n\n\n<p><strong>MSORCL32.DLL:NO ORACLE MESSAGE MUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\msorcl32.dll<\/li><\/ul>\n\n\n\n<p><strong>MSScreenMagnifierAlreadyExistsMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\winlogon.exe<\/li><\/ul>\n\n\n\n<p><strong>MSScreenMagnifierContextAreaMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\Magnify.exe<\/li><li>Windows\\System32\\Magnify.exe<\/li><\/ul>\n\n\n\n<p><strong>MS_FAXXP_ATTACHMENTREGION_MUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\FXSAPI.dll<\/li><li>Windows\\System32\\FXSCOMPOSE.dll<\/li><\/ul>\n\n\n\n<p><strong>MS_FAXXP_ATTACHMENT_MUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\FXSAPI.dll<\/li><li>Windows\\System32\\FXSCOMPOSE.dll<\/li><\/ul>\n\n\n\n<p><strong>ManagedAccountManager{8466CE10-BD83-44BF-81A9-9B35D36EB77C}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\assignedaccessmanagersvc.dll<\/li><\/ul>\n\n\n\n<p><strong>Microsoft.Windows.Migration.MigWiz<\/strong><\/p>\n\n\n\n<ul><li>Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll<\/li><li>Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll<\/li><\/ul>\n\n\n\n<p><strong>Microsoft.Windows.Setup.FirstUXRefCount<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\spwizeng.dll<\/li><li>Windows\\System32\\sppnp.dll<\/li><li>Windows\\System32\\spwizeng.dll<\/li><\/ul>\n\n\n\n<p><strong>Microsoft_WMP_70_CheckForOtherInstanceMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\wmpshell.dll<\/li><li>Windows\\System32\\wmpshell.dll<\/li><\/ul>\n\n\n\n<p><strong>Mutex:Pubwiz:Icons<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\shwebsvc.dll<\/li><li>Windows\\System32\\shwebsvc.dll<\/li><\/ul>\n\n\n\n<p><strong>Mutex:Pubwiz:Regs<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\shwebsvc.dll<\/li><li>Windows\\System32\\shwebsvc.dll<\/li><\/ul>\n\n\n\n<p><strong>Notification serialiazer Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\InstallService.dll<\/li><li>Windows\\System32\\InstallService.dll<\/li><\/ul>\n\n\n\n<p><strong>OFFLINEDEVICEID-CREATERANDOMSEED<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\ClipSVC.dll<\/li><li>Windows\\System32\\TpmTasks.dll<\/li><\/ul>\n\n\n\n<p><strong>OOC State Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\hidserv.dll<\/li><li>Windows\\System32\\hidserv.dll<\/li><\/ul>\n\n\n\n<p><strong>ORTC_TracingLock<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\rtmpal.dll<\/li><li>Windows\\System32\\rtmpal.dll<\/li><\/ul>\n\n\n\n<p><strong>OnlineHistoryUUIDGenLock<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\EdgeContent.dll<\/li><\/ul>\n\n\n\n<p><strong>PRESENTATIONSETTINGS_MUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\PresentationSettings.exe<\/li><\/ul>\n\n\n\n<p><strong>PRWIZARDMUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\keymgr.dll<\/li><li>Windows\\System32\\keymgr.dll<\/li><\/ul>\n\n\n\n<p><strong>Provisioning\\ProvMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\provcore.dll<\/li><li>Windows\\System32\\provcore.dll<\/li><\/ul>\n\n\n\n<p><strong>RasPbFile<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\rasplap.dll<\/li><li>Windows\\System32\\rasapi32.dll<\/li><li>Windows\\System32\\rasdlg.dll<\/li><li>Windows\\System32\\rasgcw.dll<\/li><li>Windows\\System32\\rasmans.dll<\/li><li>Windows\\System32\\rasplap.dll<\/li><\/ul>\n\n\n\n<p><strong>RdpClipAlreadyRunningMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\rdpclip.exe<\/li><\/ul>\n\n\n\n<p><strong>RdpInputAlreadyRunningMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\rdpclip.exe<\/li><li>Windows\\System32\\rdpinput.exe<\/li><\/ul>\n\n\n\n<p><strong>RecommendedTroubleshootingServiceMutexName<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\MitigationClient.dll<\/li><\/ul>\n\n\n\n<p><strong>Search Admin Control Panel<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\srchadmin.dll<\/li><li>Windows\\System32\\srchadmin.dll<\/li><\/ul>\n\n\n\n<p><strong>SearchServiceMUT<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\SearchIndexer.exe<\/li><li>Windows\\System32\\SearchIndexer.exe<\/li><\/ul>\n\n\n\n<p><strong>SetuplogMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\setupapi.dll<\/li><li>Windows\\System32\\setupapi.dll<\/li><\/ul>\n\n\n\n<p><strong>ShellNewConsolidationMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\shell32.dll<\/li><\/ul>\n\n\n\n<p><strong>ShellNewConsolidationMutex64<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\shell32<\/li><\/ul>\n\n\n\n<p><strong>SpellingHostSingletonMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\MsSpellCheckingHost.exe<\/li><\/ul>\n\n\n\n<p><strong>StoreCacheInit_Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\Windows.CloudStore.dll<\/li><\/ul>\n\n\n\n<p><strong>System_Feed_Scheduler_Mutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\msfeeds.dll<\/li><li>Windows\\System32\\msfeeds.dll<\/li><\/ul>\n\n\n\n<p><strong>TSLicensingLock<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\tlscsp.dll<\/li><li>Windows\\System32\\tlscsp.dll<\/li><\/ul>\n\n\n\n<p><strong>TabCalSingleInstance<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\tabcal.exe<\/li><\/ul>\n\n\n\n<p><strong>TapisrvProviderListMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\tapi32.dll<\/li><li>Windows\\SysWOW64\\tapisrv.dll<\/li><li>Windows\\SysWOW64\\tcmsetup.exe<\/li><li>Windows\\System32\\tapi32.dll<\/li><li>Windows\\System32\\tapisrv.dll<\/li><li>Windows\\System32\\tcmsetup.exe<\/li><\/ul>\n\n\n\n<p><strong>TraceLogStorageMutex<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\IndexedDbLegacy.dll<\/li><li>Windows\\System32\\IndexedDbLegacy.dll<\/li><\/ul>\n\n\n\n<p><strong>WBEMPROVIDERSTATICMUTEX<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\framedyn.dll<\/li><li>Windows\\SysWOW64\\framedynos.dll<\/li><\/ul>\n\n\n\n<p><strong>WMSetup10RTM-UI<\/strong><\/p>\n\n\n\n<ul><li>Program Files (x86)\\Windows Media Player\\setup_wm.exe<\/li><li>Program Files\\Windows Media Player\\setup_wm.exe<\/li><\/ul>\n\n\n\n<p><strong>WdsSetupLogInit<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\ieUnatt.exe<\/li><li>Windows\\SysWOW64\\wdscore.dll<\/li><li>Windows\\System32\\DismApi.dll<\/li><li>Windows\\System32\\UpdateAgent.dll<\/li><li>Windows\\System32\\ieUnatt.exe<\/li><li>Windows\\System32\\mssrch.dll<\/li><li>Windows\\System32\\wdscore.dll<\/li><\/ul>\n\n\n\n<p><strong>Windows Volume App Window<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\SndVol.exe<\/li><li>Windows\\SysWOW64\\SndVolSSO.dll<\/li><li>Windows\\System32\\SndVol.exe<\/li><li>Windows\\System32\\SndVolSSO.dll<\/li><\/ul>\n\n\n\n<p><strong>WindowsInsiderServiceMutexName<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\FlightSettings.dll<\/li><li>Windows\\System32\\FlightSettings.dll<\/li><\/ul>\n\n\n\n<p><strong>WindowsPhotoGallerySlideshow<\/strong><\/p>\n\n\n\n<ul><li>Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll<\/li><li>Program Files\\Windows Photo Viewer\\PhotoViewer.dll<\/li><\/ul>\n\n\n\n<p><strong>WofCompressionPolicyEval<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\WofUtil.dll<\/li><li>Windows\\SysWOW64\\compact.exe<\/li><li>Windows\\System32\\WofUtil.dll<\/li><li>Windows\\System32\\compact.exe<\/li><\/ul>\n\n\n\n<p><strong>_SHuassist.mtx<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\shell32.dll<\/li><li>Windows\\System32\\shell32<\/li><\/ul>\n\n\n\n<p><strong>__EXTENSION_POINTS_STATE_MUTEX__<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\Windows.UI.Search.dll<\/li><li>Windows\\SysWOW64\\twinui.appcore.dll<\/li><li>Windows\\SysWOW64\\twinui.dll<\/li><li>Windows\\System32\\ApplicationFrame.dll<\/li><li>Windows\\System32\\SettingsHandlers_nt.dll<\/li><li>Windows\\System32\\Windows.UI.Search.dll<\/li><li>Windows\\System32\\twinui.appcore.dll<\/li><li>Windows\\System32\\twinui.dll<\/li><\/ul>\n\n\n\n<p><strong>__MDM_LOCAL_MANAGEMENT_NAMED_MUTEX__<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\mdmlocalmanagement.dll<\/li><li>Windows\\System32\\mdmlocalmanagement.dll<\/li><\/ul>\n\n\n\n<p><strong><a href=\"https:\/\/learn.microsoft.com\/vi-vn\/windows\/win32\/msi\/--msipromptforcd-mutex\">__MsiPromptForCD<\/a><\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\msi.dll<\/li><li>Windows\\System32\\msi.dll<\/li><\/ul>\n\n\n\n<p><strong>__OMADM_NAMED_MUTEX__<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\omadmapi.dll<\/li><li>Windows\\System32\\omadmapi.dll<\/li><\/ul>\n\n\n\n<p><strong>___ENUMDEVSYNCH___<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\msmpeg2vdec.dll<\/li><li>Windows\\System32\\msmpeg2vdec.dll<\/li><\/ul>\n\n\n\n<p><strong>__clickonce_app_store__<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\dfshim.dll<\/li><li>Windows\\System32\\dfshim.dll<\/li><\/ul>\n\n\n\n<p><strong>eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\qedit.dll<\/li><li>Windows\\System32\\qedit.dll<\/li><\/ul>\n\n\n\n<p><strong>g_nTpmCoreProvisioningClass_SerializationMutex_<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\TpmCoreProvisioning.dll<\/li><li>Windows\\System32\\TpmCoreProvisioning.dll<\/li><\/ul>\n\n\n\n<p><strong>x9pv45dxghk<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\winipcsecproc.dll<\/li><li>Windows\\System32\\winipcsecproc.dll<\/li><\/ul>\n\n\n\n<p><strong>{08E99B95-8687-49A7-9F6E-21D4EEA9346F}<\/strong><\/p>\n\n\n\n<ul><li>Program Files\\Windows Defender\\Offline\\OfflineScannerShell.exe<\/li><\/ul>\n\n\n\n<p><strong>{14B2AE96-6F90-421C-A255-E7916D51FEF1}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\srmscan.dll<\/li><li>Windows\\System32\\srmscan.dll<\/li><\/ul>\n\n\n\n<p><strong>{4ae7cdb7-4608-4a6a-b8f1-55d7c500f2ef}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\cofire.exe<\/li><\/ul>\n\n\n\n<p><strong>{5312EE61-79E3-4A24-BFE1-132B85B23C3A}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\iedkcs32.dll<\/li><li>Windows\\SysWOW64\\msfeeds.dll<\/li><li>Windows\\System32\\ie4uinit.exe<\/li><li>Windows\\System32\\iedkcs32.dll<\/li><li>Windows\\System32\\msfeeds.dll<\/li><\/ul>\n\n\n\n<p><strong>{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\iedkcs32.dll<\/li><li>Windows\\System32\\ie4uinit.exe<\/li><li>Windows\\System32\\iedkcs32.dll<\/li><\/ul>\n\n\n\n<p><strong>{91ff306c-a88d-4173-9df3-f9fb73e3b047}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\DFDWiz.exe<\/li><\/ul>\n\n\n\n<p><strong>{9ebf696d-2428-4dc4-b048-d46c6da4b717}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\System32\\BdeHdCfg.exe<\/li><\/ul>\n\n\n\n<p><strong>{A5B99A4D-2959-11D1-BAC8-00C04FC2E20D}<\/strong><\/p>\n\n\n\n<ul><li>Windows\\SysWOW64\\iaspolcy.dll<\/li><li>Windows\\SysWOW64\\iasrad.dll<\/li><li>Windows\\SysWOW64\\iassvcs.dll<\/li><li>Windows\\System32\\iaspolcy.dll<\/li><li>Windows\\System32\\iasrad.dll<\/li><li>Windows\\System32\\iassvcs.dll<\/li><\/ul>\n\n\n\n<p><strong>{D4445657-0FBC-11dc-A692-00037AF63586}<\/strong><\/p>\n\n\n\n<ul><li>Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe<\/li><li>Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A few years ago I released a list of &#8216;bad&#8217; mutexes\/mutants. That list was generated from my malware sandbox reports. I thought that it may be good to revisit the idea, but this time with a focus on a &#8216;clean&#8217; &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2023\/03\/12\/list-of-clean-mutexes-and-mutants\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[79],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8443"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=8443"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8443\/revisions"}],"predecessor-version":[{"id":8446,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8443\/revisions\/8446"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=8443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=8443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=8443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}