Overview

overview

8

Static

static

3

ep_setup.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    533s
  • max time network
    509s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09-11-2024 04:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ep_setup.exe

  • Size

    10.6MB

  • MD5

    f164888a6fbc646b093f6af6663f4e63

  • SHA1

    3c0bb9f9a4ad9b1c521ad9fc30ec03668577c97c

  • SHA256

    8c5a3597666f418b5c857e68c9a13b7b6d037ea08a988204b572f053450add67

  • SHA512

    f1b2173962561d3051ec6b5aa2fc0260809e37e829255d95c8a085f990c18b724daff4372f646d505dabe3cc3013364d4316c2340527c75d140dbc6b5ebdeee1

  • SSDEEP

    196608:Yobw/inDWIRviYy06kRUEsyiFo2ItCC2bO+WxNtTYnepC5YbM/rN2kGBlSrnU:dw/2Bvc06kiEviXTCIKNtUnqYYA/A

Score
8/10
discoveryevasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 44 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 12 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 14 IoCs
  • Kills process with taskkill 7 IoCs
    evasion
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 19 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\dwm.exe
    "dwm.exe"
    1⤵
      PID:464
    • C:\Users\Admin\AppData\Local\Temp\ep_setup.exe
      "C:\Users\Admin\AppData\Local\Temp\ep_setup.exe"
      1⤵
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4600
      • C:\Windows\system32\sc.exe
        "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
        2⤵
        • Launches sc.exe
        PID:4824
      • C:\Windows\system32\sc.exe
        "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
        2⤵
        • Launches sc.exe
        PID:2088
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
        2⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:2676
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
        2⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:564
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Loads dropped DLL
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3840
        • C:\Users\Admin\AppData\Local\Temp\ep_setup.exe
          "C:\Users\Admin\AppData\Local\Temp\ep_setup.exe"
          3⤵
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:3732
          • C:\Windows\system32\taskkill.exe
            "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
            4⤵
            • Kills process with taskkill
            PID:1456
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
            4⤵
            • Launches sc.exe
            PID:2396
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
            4⤵
            • Launches sc.exe
            PID:4180
          • C:\Windows\system32\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
            4⤵
            • Loads dropped DLL
            PID:3668
          • C:\Windows\system32\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
            4⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4256
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Loads dropped DLL
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3836
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\system32\rundll32.exe" "C:\Program Files\ExplorerPatcher\ep_gui.dll",ZZGUI
              5⤵
              • Loads dropped DLL
              • Modifies Control Panel
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3784
              • C:\Windows\system32\taskkill.exe
                "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
                6⤵
                • Kills process with taskkill
                PID:716
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe"
                6⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Loads dropped DLL
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of SetWindowsHookEx
                PID:4116
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                6⤵
                • Loads dropped DLL
                • Modifies registry class
                PID:4340
              • C:\Windows\system32\regsvr32.exe
                "C:\Windows\system32\regsvr32.exe" "C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll"
                6⤵
                • Loads dropped DLL
                • Modifies registry class
                PID:1212
              • C:\Windows\system32\taskkill.exe
                "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
                6⤵
                • Kills process with taskkill
                PID:772
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe"
                6⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Loads dropped DLL
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of SetWindowsHookEx
                PID:476
              • C:\Windows\system32\taskkill.exe
                "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
                6⤵
                • Kills process with taskkill
                PID:2476
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe"
                6⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Loads dropped DLL
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:2752
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" create ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB binPath= "\"C:\Program Files\ExplorerPatcher\ep_dwm.exe\" ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB Global\ep_dwm_2_D17F1E1A-5919-4427-8F89-A1A8503CA3EB" DisplayName= "ExplorerPatcher Desktop Window Manager Service" start= auto & "C:\Windows\system32\sc.exe" description ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB "Service for managing aspects related to the Desktop Window Manager." & "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2296
                • C:\Windows\system32\sc.exe
                  "C:\Windows\system32\sc.exe" create ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB binPath= "\"C:\Program Files\ExplorerPatcher\ep_dwm.exe\" ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB Global\ep_dwm_2_D17F1E1A-5919-4427-8F89-A1A8503CA3EB" DisplayName= "ExplorerPatcher Desktop Window Manager Service" start= auto
                  7⤵
                  • Launches sc.exe
                  PID:232
                • C:\Windows\system32\sc.exe
                  "C:\Windows\system32\sc.exe" description ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB "Service for managing aspects related to the Desktop Window Manager."
                  7⤵
                  • Launches sc.exe
                  PID:4900
                • C:\Windows\system32\sc.exe
                  "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
                  7⤵
                  • Launches sc.exe
                  PID:4496
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3628
                • C:\Windows\system32\sc.exe
                  "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
                  7⤵
                  • Launches sc.exe
                  PID:2520
                • C:\Windows\system32\sc.exe
                  "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
                  7⤵
                  • Launches sc.exe
                  PID:3504
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" create ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB binPath= "\"C:\Program Files\ExplorerPatcher\ep_dwm.exe\" ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB Global\ep_dwm_2_D17F1E1A-5919-4427-8F89-A1A8503CA3EB" DisplayName= "ExplorerPatcher Desktop Window Manager Service" start= auto & "C:\Windows\system32\sc.exe" description ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB "Service for managing aspects related to the Desktop Window Manager." & "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB"
                6⤵
                  PID:3368
                  • C:\Windows\system32\sc.exe
                    "C:\Windows\system32\sc.exe" create ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB binPath= "\"C:\Program Files\ExplorerPatcher\ep_dwm.exe\" ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB Global\ep_dwm_2_D17F1E1A-5919-4427-8F89-A1A8503CA3EB" DisplayName= "ExplorerPatcher Desktop Window Manager Service" start= auto
                    7⤵
                    • Launches sc.exe
                    PID:1452
                  • C:\Windows\system32\sc.exe
                    "C:\Windows\system32\sc.exe" description ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB "Service for managing aspects related to the Desktop Window Manager."
                    7⤵
                    • Launches sc.exe
                    PID:3972
                  • C:\Windows\system32\sc.exe
                    "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
                    7⤵
                    • Launches sc.exe
                    PID:3060
                • C:\Windows\system32\taskkill.exe
                  "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
                  6⤵
                  • Kills process with taskkill
                  PID:3032
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe"
                  6⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Loads dropped DLL
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  PID:744
                • C:\Windows\system32\taskkill.exe
                  "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
                  6⤵
                  • Kills process with taskkill
                  PID:2420
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe"
                  6⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Loads dropped DLL
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  PID:4384
                  • C:\Windows\system32\taskmgr.exe
                    "C:\Windows\system32\taskmgr.exe" /4
                    7⤵
                    • Loads dropped DLL
                    • Checks SCSI registry key(s)
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2256
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\system32\rundll32.exe" "C:\Program Files\ExplorerPatcher\ep_gui.dll",ZZGUI
                5⤵
                • Loads dropped DLL
                PID:3744
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1704
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4592
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:3920
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Enumerates system info in registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:896
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:2296
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
          1⤵
            PID:2004
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
            1⤵
              PID:3612
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4256
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Enumerates system info in registry
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:4864
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Enumerates system info in registry
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:4912
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4840
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4232
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Enumerates system info in registry
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:948
            • C:\Program Files\ExplorerPatcher\ep_dwm.exe
              "C:\Program Files\ExplorerPatcher\ep_dwm.exe" ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB Global\ep_dwm_2_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
              1⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4448
            • C:\Program Files\ExplorerPatcher\ep_dwm.exe
              "C:\Program Files\ExplorerPatcher\ep_dwm.exe" ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB Global\ep_dwm_2_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
              1⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:3764
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4104
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Enumerates system info in registry
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:2640
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Loads dropped DLL
              • Enumerates system info in registry
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:352
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:3128
            • C:\Windows\system32\BackgroundTransferHost.exe
              "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
              1⤵
              • Modifies registry class
              PID:3840

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            System Services

            2
            T1569

            Service Execution

            2
            T1569.002

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Impair Defenses

            1
            T1562

            Modify Registry

            2
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            6
            T1012

            System Information Discovery

            5
            T1082

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Service Stop

            1
            T1489

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll
              Filesize

              153KB

              MD5

              e5bb14c2b9af4d5bf6c38e0759f454dd

              SHA1

              8ce23be643a9ac1745ee824ff91621a0b8fcdaf8

              SHA256

              a4fd75ac8f852edc8bdb88a705eeee2c93f6ec51ef9fa0739a11a690a067c66d

              SHA512

              d2e0e3176304289f0efe635d3f751a6389b48afff4e2348e478993a29aba7941624e53f076bc09bba4ba0470e171cd2582254261584d2369d7ceb9dbd45a56cb

              Download Submit

            • C:\Program Files\ExplorerPatcher\WebView2Loader.dll
              Filesize

              161KB

              MD5

              c5f0c46e91f354c58ecec864614157d7

              SHA1

              cb6f85c0b716b4fc3810deb3eb9053beb07e803c

              SHA256

              465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f

              SHA512

              287756078aa08130907bd8601b957e9e006cef9f5c6765df25cfaa64ddd0fff7d92ffa11f10a00a4028687f3220efda8c64008dbcf205bedae5da296e3896e91

              Download Submit

            • C:\Program Files\ExplorerPatcher\ep_dwm.exe
              Filesize

              115KB

              MD5

              6563c5338177ff66050eadfe3960c567

              SHA1

              20e6e7c7778861756549062c5c0715090cad0e52

              SHA256

              315af6df079b31bac26156c9dda8cc415c76408a39972346c238888aaff79921

              SHA512

              724b9823e36b99490cd9b86a9b6ef33c35c5f92761abf7d6b2d00c0398b14679dfd07189519025e89f8dcef2409b0fdfaa48edf77b07764a4ed6cf6c683b330c

              Download Submit

            • C:\Program Files\ExplorerPatcher\ep_gui.dll
              Filesize

              734KB

              MD5

              81cd6d96f81b1e54aa327a4af6bcbe85

              SHA1

              b786c4bde03d1566b1b040eb8970b82f7b80a007

              SHA256

              b23bab1f5dc85c9e10145eeb32214d6cfe02fb5abcf956a37a3c9dd7e09fee67

              SHA512

              a1360b71ba11b529bd21f8c93c6ceec01c4faa9d33ca5e5fa62acb118cebf1e9e1d38ea17d236d1f8bd0d790f6b743329d41598d5a62c794b4786c14975782be

              Download Submit

            • C:\Program Files\ExplorerPatcher\ep_setup.exe
              Filesize

              10.6MB

              MD5

              f164888a6fbc646b093f6af6663f4e63

              SHA1

              3c0bb9f9a4ad9b1c521ad9fc30ec03668577c97c

              SHA256

              8c5a3597666f418b5c857e68c9a13b7b6d037ea08a988204b572f053450add67

              SHA512

              f1b2173962561d3051ec6b5aa2fc0260809e37e829255d95c8a085f990c18b724daff4372f646d505dabe3cc3013364d4316c2340527c75d140dbc6b5ebdeee1

              Download Submit

            • C:\Program Files\ExplorerPatcher\ep_weather_host.dll
              Filesize

              238KB

              MD5

              aac2857727cff3cd7b291f9500196f73

              SHA1

              c86eedff45b672df58885f12e7a7aee3398c618b

              SHA256

              78ed3e3676d97c337fef071b522805f4cf742587a40f96af4aa4d74fee0af88a

              SHA512

              a4c54b4221b1745fe1de6d53fcd7a528b4bacda6b2c66e02d55bd5867d118e042a35490e45b64c2d24398a9ac06e356bf10a2822f83663d52c1a28e10f0a52e5

              Download Submit

            • C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
              Filesize

              109KB

              MD5

              e477912c435db101603781dcc44289e1

              SHA1

              7b2eda1b6055e8874f37fb9b48bcc933bf69c1c3

              SHA256

              0930d2e71353a411d96dc4dfdd473dace98d1b7b9546ac4c185f8984f8b9c18b

              SHA512

              9f8089742099a789387381980ec5b493deec46bd73f39cf8fa9919be4dd772b20c70246e5e90d625011f052d5c3b2000b42c50843956d74fb85ff1b1d18eace9

              Download Submit

            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
              Filesize

              1KB

              MD5

              8757e2986e74831e2742729a753fd1eb

              SHA1

              1117788db77a05c1d5661bb01b878ce9568ce086

              SHA256

              e0b4eea162ea01302b1b6ef7b967bb17b3029992b547dba624e92e67e006f31f

              SHA512

              2cc69ca6c91211e8b251c9e064fceea140ae5141a31e01d86092c3c9827d06a8898a825775b4227d1582719e81653881d185bf316e6c865533295e20bde9e060

              Download Submit

            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
              Filesize

              1KB

              MD5

              e2697b3de408b2d6110dd32b2332bdc7

              SHA1

              b722117edadb73b24c2f0b1c96f803f3b04afa50

              SHA256

              26d0ee5bb8c274894d004fecb426fae0c4634847f87f82b635ff06bf9e820a4e

              SHA512

              8417d565fc8f30e66560a40bca73a1619c451ab2b56e2d4096a11db8bf270e8a8d1a492569754298ec211f9470378ec6eae1045bf95cf7cc6690d10b28495720

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C
              Filesize

              281B

              MD5

              58678424e65b3d7ec2483bc83780e32c

              SHA1

              9bf244034218333ee6e011c97d5617871a3b67fc

              SHA256

              9d18e97fcd9c6dd943f50f7d0c6f50be8e84dcb86849541a831a3c755284ad29

              SHA512

              5d2b2872632c31bb1c316eddd8662c9df0eb49ea78801e07cb41dc845ae24e50f27f62009958fdd7cd664be11f0407d94763fde5ff0b958f4367cb563be0d26a

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
              Filesize

              1KB

              MD5

              ee536ac620dd4c72cadc3bb362526df5

              SHA1

              e11e70e033243e3a181204d60cb2c0366da2ab40

              SHA256

              93aae0e2a061c2a9a685aa62077063be31e9a4f566749b4cff16eb247b9760b7

              SHA512

              f543ca02d0150e0641a5af56fab48c5af00f10d51031def987cd91767f0d3e5af097ce3838d74822416ebe08a02db07c1b2f4b067972826fc14bdc552048ae00

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
              Filesize

              978B

              MD5

              d0e609d7edec843d1ba67e83ad3f336a

              SHA1

              8775520b0a24ffd7215604d97eeb441f1f487889

              SHA256

              b36b0dee37be7bc91f7e5f89705e40665b7a1ad2cfc939a2bbd4a57254689207

              SHA512

              e96da4ef214fdaba47d9307cfdc8067e1504ba8e796c603c6d37ffbd4d2ecf82f0109708a30fa53e84fa44e82d21059710d2564543531b871bc08cb99964aa80

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
              Filesize

              471B

              MD5

              2d3b7991dd9bdeaf0da9fc3853cc55f7

              SHA1

              c624f52187540acc7a6d16914770f5e8ee09896d

              SHA256

              ec368460775d2be51bb92836350ce107075c2c1abeecf1da5ec6ca5a5aa1f22d

              SHA512

              c55219237865e1a321cfdd06f3fc3ddc6703246101ae031c34925621b1ea825e5150865fae7d8c11b1557116073efa27372846b00e00bf21e30ee86f6ec0a3b3

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C
              Filesize

              480B

              MD5

              223ff30db0a3a66d749e4a1621eb1fee

              SHA1

              2c59c5569fcc1c2fb7a395142753428d80b97e1b

              SHA256

              5a5d171faf1e5bf6ea71c884773ae33045c83f57804bfeb56a6007a008d42088

              SHA512

              1a4da0a0649019c737650950780a637ce7bd0473f9edcdd8a2c264cfbbebdc15d409cbd79f09a79da469c0c6868d978c2dee6690cc73601b97f3d86c422686c4

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
              Filesize

              482B

              MD5

              6888932a8e3fb2931b5262f68644543c

              SHA1

              df829a97a55552551bb9aac321353633a347ceae

              SHA256

              320776d6a60a724b13f7f2783bc9b043728ee46715b9ea0388ddb0a8f2b79c30

              SHA512

              3e070064fa1482664adfc128439e4b1e653398dfc98226826eaa76cf0c30d532c9ef202bc7918c8e25e47a56bcb468ed65507d84a40afe6fd4aa9a06cbf94a6a

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
              Filesize

              480B

              MD5

              0c54ab3fa0d0184ea8260e9dcc18fd49

              SHA1

              d90c59fa5f5b53b0f61cbe01a74880b65c2aef1b

              SHA256

              2e28c7e5b1860c345ea655da8ee2983332ed0def942f85f8c9152f461e0762c6

              SHA512

              3e13480675fc9dc2d2376a8ebcb317bcb4a739df40c1040adf91deedd853292a9d1530d9c529aa96c97d7726884e862f7527a6056184cc38aeff5294ab6a64d8

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
              Filesize

              412B

              MD5

              4e1fd9d9c30f4f472f79e34316785ae2

              SHA1

              62ed4004277b25b5f025ee8fe836b080a65d1a29

              SHA256

              ec3b7ad063f47cbbfd2d4c486bab3e84078253fec5ffb3b40575aa83ac417d7c

              SHA512

              31bac75ec1344ca709e2bfa2055449425c490271618e70a293c1ee061cfa8d8f877ff33aa4408bc852b63c1eb053c990bed1b36d1f971841f4065d837442e51f

              Download Submit

            • C:\Users\Admin\AppData\Local\IconCache.db
              Filesize

              16KB

              MD5

              ab76662b65968513bfc71572562dc796

              SHA1

              3d258015d3e1ff64c03ee2a38caeeccd3428cb6b

              SHA256

              1a91f90170ecbc4c40f4b5ea85dd1de3f0f22f7cc192ed31ce51ee98d7734235

              SHA512

              285450a758ebd9c33f3b3c3618b5c21f76b89541c48a3a6de482cbc04a3357e37d421eb23a2938322028680efd293cc89cadac2cdb9ad0316fd3906423e068aa

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
              Filesize

              1022B

              MD5

              f45ff6078316d42384c1b61763e7dc62

              SHA1

              be216d9f7f911891db1bbaa4404dc87f514f39c7

              SHA256

              013d966e3695f1904bf6074049233d3d84ce5197340c9a54183b962d84c925c3

              SHA512

              10d2ebab1ec352d5f48eeae905142d995a957b00d604272acde2a284ea948deaa52e2b82a171ad342007bd1c960725c7dfa169499a2a3f43d6c3ff15e199f4aa

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start.bin
              Filesize

              3KB

              MD5

              0de6b60a58f2914f3c740fcb8a470af2

              SHA1

              b429eb2c47a436cac276199f683e0f08c5c63ed0

              SHA256

              ab8c1c23dd3a3545f472722f7d92a8d7fe9b28258b6125f015758b287e36df47

              SHA512

              323ca6a70555b2de6a8fd29ca534aab02f2ed989d8b5f66d58916c0eaf0efa1b321fc9d239e5d38c1f74a392cc2512ed1c79a781a7a22962877f9b2f0dc3fa3d

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\85aedfa0-2f5d-4bf4-8ddb-ed6f0344e896.down_data
              Filesize

              555KB

              MD5

              5683c0028832cae4ef93ca39c8ac5029

              SHA1

              248755e4e1db552e0b6f8651b04ca6d1b31a86fb

              SHA256

              855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

              SHA512

              aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7955VA1W\www.bing[1].xml
              Filesize

              326B

              MD5

              fdb75285c8fa0f0d405315e40bb28e8c

              SHA1

              ba7ad9385a0cfed64b5311ab11f9b0eb0d1bb9af

              SHA256

              47268e94c92891f25244cfe43208aebb5fd82d01daa92099161fc64b7b9b6080

              SHA512

              ed83ae2bfb88e8f687922d1040c60bad27577b335ff71fc66c9aa84f3ef594ecee0f41552a8c64cfade706568d0928002a798a232762693970fc809b765591ec

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7955VA1W\www.bing[1].xml
              Filesize

              15KB

              MD5

              828258e40e851f4dca8ba6c18305a654

              SHA1

              206ca30e8edbe61b50f65f2754d65a166d6ce5b8

              SHA256

              bd4dc149bb7b8fb73baedd426ea042e88a28bef93e2194352efae210c68facda

              SHA512

              af33ca3ab43867370f1aaa2b246178b2f04af854ae8b8962a7ea87c0d41438969b4a172fcc22636e0bcefb6db2f27044ae3a59cfe2e8dcfc97881f5ab0b8bec3

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7955VA1W\www.bing[1].xml
              Filesize

              15KB

              MD5

              17363daecaeaad56c31b9e42ee7798a1

              SHA1

              d806a928bd39bc35ab07109ce4770bc7077c6832

              SHA256

              fd2f5a829baf77bed88f902b265507bc8e789ecba420259c5fb1c96100d61483

              SHA512

              f1ae966d0dbf29e05707f2a65937e66c0d16cfdfd522521f230ed82cf1d4dba139584a2bd7b2edf3be217213789799599eba543e93e96b97fa1bb88439fc904c

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7955VA1W\www.bing[1].xml
              Filesize

              327B

              MD5

              4c20a3709197fe284b81b5542cce08db

              SHA1

              1efced9b81654de4060a1c711df57f4908292c78

              SHA256

              d7e34450999a2de8f2102bf44a8227ea2b92b04e551d3a0919b042714ac56a8c

              SHA512

              db2d1d9ac8f3db9bc60207a8d49fcbe18d695d773483d45bcc068e027bc5f80e47e81719630bd5c3abe1b0140c73f033ffd854900aa0020204d9772dcb74b206

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7955VA1W\www.bing[1].xml
              Filesize

              15KB

              MD5

              ca9f8f728b736d93172255252a682a0e

              SHA1

              f8954e85d078aa3959e92b6f9c0531ac1970d44f

              SHA256

              4c7ce643b31c8d9a0d7aa0f85cfd158c7fe6e07419ba6a139911467a8f4efd67

              SHA512

              a2fa2fd146b41000098d92aa9da1851b06915c6bf24fbb728127c52d0106c235093d27f89d646bd3d0c6db7950ecacc1b582e814ac734dfc6ddfa016d4892e59

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7955VA1W\www.bing[1].xml
              Filesize

              15KB

              MD5

              586496b58161d01ef166bad8c1aeeb8c

              SHA1

              0a2db023e61fd29aae29e9cbf692bfe96c38dcf4

              SHA256

              f71af44339adcc95853a637bec057329f5eb2f86246008244c10b44ef2742069

              SHA512

              8a296454ebdb757b92dcb6099c731764b318fd4518025d582d579694a21a6e25410dc415a82b73c73bd1897ad21ecc6d2c2284d27f7a226338fca48a067fa002

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7955VA1W\www.bing[1].xml
              Filesize

              326B

              MD5

              e51f392a8909bad23590cf60ea77ff2d

              SHA1

              c8d2123fccf115a28e0f6cd11e3b0ea35676fd25

              SHA256

              613a4f722aa1f47d1bf6ea3303e418412db4f827dfa7e3bdb4d0885dd78b567b

              SHA512

              cb862dcd3e92bd5a38f38c110faf52786e2e45281c48b8c7378c1f9a15ecc6c5d26fa081399b9f3c741ecd18cd1cfb27d426d67b60017bae1fa59a35fa985139

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7955VA1W\www.bing[1].xml
              Filesize

              17KB

              MD5

              00180149065f339d1af2e1f067c490f2

              SHA1

              e535cf5c4e04426592a2cfab5cebfbe03e2c7248

              SHA256

              59a5001340f0459d669b908fd0791e6f0401b08dbffab10a98a3f8d2bc75583b

              SHA512

              4fc0dd34c66f2dfaf9f4a8af6df4e17d581a81d96badf14a2739ebcbb1ce37ab8e1671a6d81bcd09b789f84784fb17645043fa9385a5a9778fe3760fd85df836

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7955VA1W\www.bing[1].xml
              Filesize

              15KB

              MD5

              dd46a426990b82a2fdaec2e09e6f2d01

              SHA1

              340e5a3a697b5ee07b1c38ba2748561a8075bff5

              SHA256

              6ed00bdbb630bff7afb115ea389fdf1c76f3ac9cbd491e533850d119af283904

              SHA512

              61a755b884dcdbc1149067bd61e95e576e939c03e835d7c76f93fd46216cc707a9003eb9a4a7cfec560d13ec1fbd2597615ae10888cc91bb7c2b0c388c57bc58

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7955VA1W\www.bing[1].xml
              Filesize

              17KB

              MD5

              375b60aaa1c720773ebdd7351cf7b28c

              SHA1

              6c3e30b72a937299c64047d1ad727c73f19ec1a4

              SHA256

              0bf731162beb473a55d003b7704645e75449c85ab933ddf45004e663a0485bbb

              SHA512

              dbc9644630f7772554c8b4213af71f4ea8c5c2ea568b93ae7f4b37664d171473b83c2c16e7bf6c3bbeebc3d2f38dc20fd0b06105cc2a2984164020cc11217778

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7955VA1W\www.bing[1].xml
              Filesize

              15KB

              MD5

              ab6c54404c292759c63b65bb492a1252

              SHA1

              9bbffe9a7584aa170c352b6244576c8271ba66c6

              SHA256

              3ba15e6ae115979a4d1fcb0d0cb2a3552aeb824a33e57997cd9ee73200fbb1a6

              SHA512

              419347bc959303a4b465ae33a231ce2ef74091e0649e5ce836f1f5d04387de6c3679870369d232d0f56b69c0a120ac0f5c45e8d289295205818826d64995797a

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\036DF633-3DB8-4CEC-9476-69B3FEC4BF17\Zrtu2hQ08VU_1.bytecode
              Filesize

              66KB

              MD5

              5b83ddd3bbac8aa8b8cb25a67428c634

              SHA1

              71121481a07920a1411e2cadcbf2d870bb933118

              SHA256

              50caba0194112260f6d44e975976ea92b8030d441780c129168fa1c75641ca82

              SHA512

              18d9483c0ef169a28d78f50eb1ccfbbaedc106a4164218a61189f7d7d0ed7b0fa19b292125cca17a69700cdc4aceed077078f762f52cb4a1c4c750208994b53a

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\036DF633-3DB8-4CEC-9476-69B3FEC4BF17\Zrtu2hQ08VU_1.metadata
              Filesize

              192B

              MD5

              01b5fff1d021b1d4ab00add9fa878d58

              SHA1

              b0a86e15347a06611ca6cf2094f6c14da95d80be

              SHA256

              2ad806ed4859db51347a130b38fbdb55aa820b94d8147ba6242704d953b50522

              SHA512

              735f2dd4d97b0a6dd5ddcbbea0a760b3d5f4442d389dbb65dd96d7db3c4c2d93e22667aaf14e0b06f6cfb128a2249c33c340786159eef7cfa8d085395534edc4

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8911cb15-a744-43b7-a1db-9ceba8b64582}\Apps.ft
              Filesize

              26KB

              MD5

              a744eb8fe5de15349ceeecc64953b0c7

              SHA1

              f391e02f3b7d1e061c64eb0f5d66cb905b9c35a3

              SHA256

              3b9e41bd8f0905645d465a462ba0473e201b907171c43df649f218a6abe4ac72

              SHA512

              9cbdf64af459ec7c4b7ad5300aa20a81f59bfc3cf292698f1a9e9b48b3b7482939c264b4cb1b0b5421617d178c3818baabab6c46acf51c18304539df7eb9cb32

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8911cb15-a744-43b7-a1db-9ceba8b64582}\Apps.index
              Filesize

              996KB

              MD5

              1255e27352432b816bb0361283dd5d05

              SHA1

              d78e5cb736ea13bcf6aebbb3ff0428a1dc9e3baf

              SHA256

              830c6179791682df189b19774d33345d3ecdc26bd88fd3bee4a14c8c5cf9b026

              SHA512

              a1c605925f0414d21da70259135a2f78b908f823759c4bb7a9f5a26d0911d89f16a2f0333f7b685b70c6fdec19db27c0cfcae163d625d0c7afc542f272888d4f

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133755986980520703.txt
              Filesize

              68KB

              MD5

              c49501de1bbb5093472658120120f742

              SHA1

              253193982c9e3cbd30d9c231b84fae9e3aa7656b

              SHA256

              76e3307ba0fa4f4596e91263f76833acf7e4d84fbad76898cf549d41d831d7eb

              SHA512

              a3f1dd3e4772c69e8681988f21faf6c31a3b182a1fbf0c0b0cd2d5f16566f3b6f2d233cda59b8e5659ee2c8457b3b28c2b83b4ff906c48b7fcda75038b7ec9dd

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\EUHDRGVD\JbElZtKU_zC_oK6Z6KX4QFPKvxQ[1].css
              Filesize

              951KB

              MD5

              e3d496a80059433097808940dadf38eb

              SHA1

              4fb36aa0be3ec193314b729987f8a416bce67ed0

              SHA256

              c878cc6455f03378e113bca620579b7a5000e8018f7e11f05ea840350f1a201a

              SHA512

              38dd999d253dc4591cca4621f0c82dfdb7682c89989e86fa1ee073aa75717fa540bf96876a251c63fcab5523d9034d58fb511f46f26c59b9de8442fb860ceab6

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\EUHDRGVD\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css
              Filesize

              6B

              MD5

              77373397a17bd1987dfca2e68d022ecf

              SHA1

              1294758879506eff3a54aac8d2b59df17b831978

              SHA256

              a319af2e953e7afda681b85a62f629a5c37344af47d2fcd23ab45e1d99497f13

              SHA512

              a177f5c25182c62211891786a8f78b2a1caec078c512fc39600809c22b41477c1e8b7a3cf90c88bbbe6869ea5411dd1343cad9a23c6ce1502c439a6d1779ea1b

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\EUHDRGVD\onra7PQl9o5bYT2lASI1BE4DDEs[1].css
              Filesize

              65KB

              MD5

              d167f317b3da20c8cb7f24e078e0358a

              SHA1

              d44ed3ec2cde263c53a1ba3c94b402410a636c5f

              SHA256

              be2e9b42fc02b16643c01833de7d1c14d8790ecc4355c76529a41fa2f7d3efad

              SHA512

              afc65b0fa648d49a5eb896be60331aa222301894e228fe5684399e9276342f6510773dffa3e7e75b8d6197bc51c732bc7fd7518e593ecd20c4884c47058d46d8

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\KET2EEMH\0JAyi_EranBDK8eN2mQk1X4guLs[2].css
              Filesize

              64KB

              MD5

              9c39b3ceebe82a0531b03055d7331336

              SHA1

              b5558d73d99222976d1031396cbb0ef56092b1d8

              SHA256

              43028921e23efc9d9031986df77ad99d6a0f4d7cb3235535c9b1b8d27438c8ef

              SHA512

              69d1c00c82b149e7f677ba29866fdfb7d45bda4cce24a002b3327b33708feffde27e16706fee9199c58f5d7140fcc1c0c3b39a751b68761c91e91ffb95e4a2bf

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\UGS22MQL\9mPvCZxJ_M6qXqPOckJnlPKda1w[1].js
              Filesize

              21KB

              MD5

              d311944c8e8fd4d967010526ed103b12

              SHA1

              f5f56c64c5b55b4c0ecea24361776c59b252c206

              SHA256

              1b6cee7997abfb5bd6127aa68056ef8ff4acfadce02a1bad8a85aa9f8d23fd49

              SHA512

              4a43023393fe896fd9b457c7b45050c7bda83a7737d4215586a1a2d83833d4f6ca42c6591c7deb8210f9038a36d421a493b2c7424ccc43145bbde29bf3a61f01

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\UGS22MQL\f4st08wpuYBQ5KWRJ3MqAsJB8zg[1].css
              Filesize

              19KB

              MD5

              3d24779c6014bcfefb3d9a80b8f3567b

              SHA1

              acd840a50f88729478e6e708bb0fa461984c916b

              SHA256

              a7ef8faa37710d7e90c9c8950c203c8da82410780f872e4f217ee636250d831f

              SHA512

              60c054e98cb6365a45469dd342f2f86aa7b2e6b83fb52cf1cbbc05317cb97aec56b3747868798cca74e3997219b1db3979ddf16d62d538a664fb66a5e3fb9ed4

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\UGS22MQL\yy4SnZtT2-rfsZpLbcm-u8xyafQ[1].css
              Filesize

              5KB

              MD5

              f17df11a7c86f77e92950d111abaf4e1

              SHA1

              f58c685feb5638a974d0f51a09fb7c7ac0978f6e

              SHA256

              72504249abb304d8b5f75a5e9182b478112e02773b8a9a276cd4982d8cf842fe

              SHA512

              d9a3989ca94d609b09ba804ec031c373ab4e67d61c2c6f66dd64bf327ceac07cd06bc35d0a51bcb75ef661c6b9e0bb40ab034e32eb659582004b23ea43bbfec5

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D
              Filesize

              312B

              MD5

              37fd43ea93ab0d7184f247dfea6f6e9d

              SHA1

              47184f03301cf6c33619bdd509943df2b14521c4

              SHA256

              b0aa46c40dc0a3d6d67cfcf514083e3c4f8db9c9ce4ab0787a0008517faf4427

              SHA512

              937ff08147e58e7d6868d2ba46335900d1bc4df94eac71dfa6d4d6da69bd53dcf75a476d2fd150ad5fb44972090f456d93f459b7b16e956f77f4a8bc56f5ceae

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D
              Filesize

              400B

              MD5

              7bb3d020456f99ed14d382ccfba1487d

              SHA1

              93e8c21b4c19ec17d219432812a6fe0d9df477a4

              SHA256

              719b6708b3e1b688d43b2f82ae21d382f10cc0afbd3580a5f8814fae363f0583

              SHA512

              b8d3af31813b52ca735db6588b370edb71b2407b6f3ee26f5039ff4d6ebfe8de557fc712b1a544aec13532fb6b35ee155bfc1e3e5148912c6e31ac5bd7414d06

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\eptAB59.tmp
              Filesize

              19KB

              MD5

              cd9dbd3f5ec5814a4f1fa6542be9352e

              SHA1

              04e8e94d40cd784a7e75bc52305c879b0f6e367b

              SHA256

              7ecd4088669a573db2c9f5d6d3d0a75f65d6271481cbdc195f12c4a88e01c733

              SHA512

              920b31ac1f11f59bc3191a64734a02801a1e5a0311663037e2f0c0e7918e9fd9e1e79d6fb8affee21b50b400f0f137e183f8e010782dec351d4b437a7103451e

              Download Submit

            • C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartDocked.pdb
              Filesize

              16.4MB

              MD5

              2e3682c2244b6604851b0d6b3eb7b248

              SHA1

              047c762af86b37f582573d3a88b68ab1ab8dbab3

              SHA256

              9ac8bf7c0a79fe47bea4ca8d364aa3e7b3f92b02a27507d704528b89e7e0e776

              SHA512

              834bec41cfb5cac51e3cad91d21327581a1180df98ce5cbe1a04ae8c5a5c793a0ac49b95dfa309162d653fc8d174b4c7f38c7f1f02d3e0907582b8f5d2ec6c87

              Download Submit

            • C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartUI.pdb
              Filesize

              34.0MB

              MD5

              8f9851f27ceebbbe2799bba2b19b3915

              SHA1

              841821920991665b6fd00952091a0501a180cd20

              SHA256

              095ad9d4d095282aa10038b86be989e543da3a547e07142ceab6f955c155b9cf

              SHA512

              9c02eca9dddda6dcb84c6ce9ffab631a4980ae25c10f2853cc124d91b099b669af508db271f02576bbf918cbf3c07e10b963c6a1a8c9482f29ca4e99258eea04

              Download Submit

            • C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
              Filesize

              24.0MB

              MD5

              def29fd81caf648be9b71298bb7513d0

              SHA1

              cd3ac3f22d51dc9d949409fd84848c4b1d8f6bab

              SHA256

              745f3e5f484b42c4650847b82ea36ff132b228d4096f49c493a2a7b1e32d5dce

              SHA512

              937ce45ba86505225e272b9ab8f1628722a8d70e523253758d6bdf8d531e279a256da3c9682aa63826c7ff0d41340bd936e88f066ba6b6c87d73370eda6ab889

              Download Submit

            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll
              Filesize

              699KB

              MD5

              8bfca71add96d3de75173d464792e2b9

              SHA1

              fe6bc3c30c26d6ce1c149b173b5d79c80102d5b9

              SHA256

              5aaa6bab20b7116b32bddba1df216f7476557bb48397e1968a49ede14e6c377d

              SHA512

              b560415727d15ceeb09e5d9e39ea2b4043848bf4239fbf5068aaac86f64b3d05d4e21eb197416db0fb4172c68f782c05aeae18ac70c27f80566040b6ba79159a

              Download Submit

            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.DLL
              Filesize

              164KB

              MD5

              b80816ee9fcdb1d9076b73fd929fc96b

              SHA1

              ff9a5a12dca164652419f5dee082af4a49b8a03b

              SHA256

              d63b9fc13c99000cf77d02ee6e5e84c825d02a92d87b728cb601681b5eb21671

              SHA512

              21cebca787a0fa0976b44315bf05b6eb4719306653ddbbfce41231244219bcd288cd8045980bacf21481ddabcf464c82795147db755148cc0e23167bbb874fd7

              Download Submit

            • C:\Windows\dxgi.dll
              Filesize

              699KB

              MD5

              047b192a9c703fc5a2c2764db869ff5c

              SHA1

              8c1494acc3119fbf8332ae3b6a4f854e5b4d37cb

              SHA256

              1971c57f88849b4069be06d3784e0968755c916fa1564a3f8f05610d3b02cdcc

              SHA512

              c7f80703db23611d56618a8b1b4ffff814a9264135e3846df99120c0ffc16da9d5b37c6465ac25d61d4f6e386d36b3de640c57c460098f06778c658cc19454cc

              Download Submit

            • memory/3836-508-0x00007FFE26530000-0x00007FFE26CDE000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3836-510-0x00007FFE1B560000-0x00007FFE1B7D1000-memory.dmp

              Filesize

              2.4MB

              Download

            • memory/3836-509-0x00007FFE1B560000-0x00007FFE1B7D1000-memory.dmp

              Filesize

              2.4MB

              Download

            • memory/3840-39-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-38-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-54-0x00007FFE11E30000-0x00007FFE12663000-memory.dmp

              Filesize

              8.2MB

              Download

            • memory/3840-476-0x0000000003690000-0x00000000037AE000-memory.dmp

              Filesize

              1.1MB

              Download

            • memory/3840-479-0x0000000003690000-0x00000000037AE000-memory.dmp

              Filesize

              1.1MB

              Download

            • memory/3840-59-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-53-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-26-0x00007FFE10580000-0x00007FFE107F1000-memory.dmp

              Filesize

              2.4MB

              Download

            • memory/3840-56-0x00007FFE26530000-0x00007FFE26CDE000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3840-417-0x0000000003690000-0x00000000037AE000-memory.dmp

              Filesize

              1.1MB

              Download

            • memory/3840-66-0x0000000003C70000-0x0000000003C71000-memory.dmp

              Filesize

              4KB

              Download

            • memory/3840-23-0x00007FFE26530000-0x00007FFE26CDE000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3840-22-0x00007FFE26530000-0x00007FFE26CDE000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3840-24-0x00007FFE10580000-0x00007FFE107F1000-memory.dmp

              Filesize

              2.4MB

              Download

            • memory/3840-29-0x00007FFE10580000-0x00007FFE107F1000-memory.dmp

              Filesize

              2.4MB

              Download

            • memory/3840-31-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-28-0x00007FFE10580000-0x00007FFE107F1000-memory.dmp

              Filesize

              2.4MB

              Download

            • memory/3840-27-0x00007FFE10580000-0x00007FFE107F1000-memory.dmp

              Filesize

              2.4MB

              Download

            • memory/3840-32-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-25-0x00007FFE10580000-0x00007FFE107F1000-memory.dmp

              Filesize

              2.4MB

              Download

            • memory/3840-33-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-34-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-35-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-60-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-40-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-41-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-45-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-50-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-43-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-44-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-46-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-42-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-49-0x00007FFE110A0000-0x00007FFE1166B000-memory.dmp

              Filesize

              5.8MB

              Download

            • memory/3840-52-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-51-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-48-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-47-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-37-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/3840-30-0x00007FFE27240000-0x00007FFE273EC000-memory.dmp

              Filesize

              1.7MB

              Download

            • memory/3840-36-0x00007FF70C550000-0x00007FF70CA14000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/4592-176-0x000001767C990000-0x000001767CA90000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4592-220-0x000001767CCD0000-0x000001767CDD0000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4592-219-0x000001767CC90000-0x000001767CCB0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4592-221-0x000001767CB10000-0x000001767CB30000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4592-78-0x0000017648800000-0x0000017648900000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4592-309-0x0000016E00BD0000-0x0000016E00CD0000-memory.dmp

              Filesize

              1024KB

              Download