Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
- Size 11.8MB
- Sample260708-evdknaaw6y
- SHA256 4f09eb3020029b4f507e6daa3492aa43d7b158f6cad326f4eed8f09feb6e29fa
- MD5 b9d9bede0473f36155039d43e4db39ed
- SHA1 5d9b08ec3c923d158990cbf1ca45cde1de019eb0
- SHA512 3b186d613abd847e8fb9450a080bf9f4fef2259d09baf849ccbb901c0a20c813373794c3cfa8f1665b6a60409362a1223518c8b42abc7fbdc70807b22827ae4c
- SSDEEP 196608:ahQZnOzVEuKRI2CgMKDhz2kRUEnyiVo2ItCC2bO+WxNtTYnePC5YbMxdxmaQBpQi:ocnOrgykiEyinTCIKNtUnEYYAxG
- TLSH T171C633297BE205C9F57BC27CD4B7554691AABE072734D8BF8650058A8D33BE2883C772
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
resource yara_rule behavioral2/files/0x000c00000001c5d9-34.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/files/0x000c00000001c5da-86.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 8 IoCs
pid Process 576 regsvr32.exe 576 regsvr32.exe 1904 regsvr32.exe 832 explorer.exe 832 explorer.exe 6100 StartMenuExperienceHost.exe 6100 StartMenuExperienceHost.exe 832 explorer.exe - Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in Program Files directory 20 IoCs
description ioc Process File created C:\Program Files\ExplorerPatcher\Windows.UI.ShellCommon.pri 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub150x150.png 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_setup.exe 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\WebView2Loader.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_dwm_svc.exe 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote150x150.png 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\BitMDL2.ttf 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\SkypeUISymbol-Regular.ttf 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_gui.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_weather_host.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\pnidui.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\en-US\pnidui.dll.mui 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_taskbar.ge.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\pris\Windows.UI.ShellCommon.en-US.pri 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub71x71.png 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote71x71.png 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_starttiledata.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe - Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\dxgi.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\dxgi.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib_orig.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2216 sc.exe 556 sc.exe 4500 sc.exe 5972 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe - Kills process with taskkill 1 IoCs
pid Process 4496 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ProxyStubClsid32\ = "{CDBF3734-F847-4F1B-B953-A605434DC1E7}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{09A30CBF-7F36-40B3-960E-4439DA39C563} explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32\ = "C:\\Program Files\\ExplorerPatcher\\ep_weather_host_stub.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\ = "ExplorerPatcher Weather Host" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7} regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{A343AD08-66C5-4BDA-8609-D90F4129D39B} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PastIconsStream = 1400000005000000010001000100000014000000494c200601000400040010001000ffffffff2100ffffffffffffffff424d3600000000000000360000002800000010000000400000000100200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010320141067af2a24daff2a24daff2a24daff141067af010103200000000000000000000000000000000000000000000000000000000000000000010103202520beef3732dcff2a24daff2a24daff2a24daff3732dcff2520beef010103200000000000000000000000000000000000000060000000ff00000000141067af3732dcfffefefeff7a76e8ff2a24daff7a76e8fffefefeff3732dcff141067af00000000000000000000000000000060000000ff000000ff000000002a24daff2a24daff7a76e8fffefefeff7a76e8fffefefeff7a76e8ff2a24daff2a24daff000000000000000000000060000000ff00000060000000ff000000002a24daff2a24daff2a24daff7a76e8fffefefeff7a76e8ff2a24daff2a24daff2a24daff000000ff000000ff000000ff0000006000000000000000ff000000002a24daff2a24daff7a76e8fffefefeff7a76e8fffefefeff7a76e8ff2a24daff2a24daff000000ff00000000000000000000000000000000000000ff00000000141067af3732dcfffefefeff7a76e8ff2a24daff7a76e8fffefefeff3732dcff141067af000000ff00000000000000000000000000000000000000ff00000000010103202520beef3732dcff2a24daff2a24daff2a24daff3732dcff2520beef01010320000000ff00000000000000000000000000000000000000ff000000000000000001010320141067af2a24daff2a24daff2a24daff141067af0101032000000000000000ff00000000000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff0000006000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000fe000000f2000000e2000000c20000000a0000007a0000007a0000007b0100007bff00000bff0000c3ff0000e3ff0000f3ff0000ffff0000ffff0000010000000800000003000000040000002c000000010000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ = "PSFactoryBuffer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\NumMethods\ = "28" regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\UserStartTime = "134279577396214957" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\IconStreams = 14000000070000000100010003000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f7c000000000000002000000ea0707004100720067006a00620065007800200033000a005600610067007200650061007200670020006e0070007000720066006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000074ae2078e323294282c1e41cb67d5b9c00000000000000000000000075f9bd71900edd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000ea0707004100620020004e00680071007600620020004200680067006300680067002000510072006900760070007200200076006600200076006100660067006e0079007900720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000200000073ae2078e323294282c1e41cb67d5b9c0000000000000000000000004ddd1673900edd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000007b0031004e005000310034005200370037002d0030003200520037002d0034005200350051002d004f003700340034002d00320052004f0031004e00520035003100390038004f0037007d005c0046007200700068006500760067006c00550072006e0079006700750046006c006600670065006e006c002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000ea0707004a0076006100710062006a006600200046007200700068006500760067006c0020002d0020004e0070006700760062006100660020006100720072007100720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000dce282ba05f4ad47b032cf0faa0e39330000000000000000000000002a5a9571900edd0100000000000000000000000000000d20218f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\DllSurrogate regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PastIconsStream = 1400000005000000010001000200000014000000494c200602000c00040010001000ffffffff2100ffffffffffffffff424d3600000000000000360000002800000010000000c0000000010020000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff00000000000000ff00000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000c00000000100010000000000000300000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff000001000000080000000400000004000000340000000100000000000000010000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\ = "ExplorerPatcher Weather Host" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ = "IEPWeather" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PromotedIconCache = "{7820NR73-23R3-4229-82P1-R41PO67Q5O9P}" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32\ = "C:\\Program Files\\ExplorerPatcher\\ep_weather_host.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Interface regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\IconStreams = 14000000070000000100010003000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f7c000000000000002000000ea0707004100720067006a00620065007800200033000a005600610067007200650061007200670020006e0070007000720066006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c00000000000000000000000075f9bd71900edd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000ea0707004100620020004e00680071007600620020004200680067006300680067002000510072006900760070007200200076006600200076006100660067006e0079007900720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c0000000000000000000000004ddd1673900edd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000007b0031004e005000310034005200370037002d0030003200520037002d0034005200350051002d004f003700340034002d00320052004f0031004e00520035003100390038004f0037007d005c0046007200700068006500760067006c00550072006e0079006700750046006c006600670065006e006c002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000ea0707004a0076006100710062006a006600200046007200700068006500760067006c0020002d0020004e0070006700760062006100660020006100720072007100720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000dce282ba05f4ad47b032cf0faa0e39330000000000000000000000002a5a9571900edd0100000000000000000000000000000d20218f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 832 explorer.exe 832 explorer.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 4496 taskkill.exe Token: 35 3948 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe Token: SeShutdownPrivilege 832 explorer.exe Token: SeCreatePagefilePrivilege 832 explorer.exe Token: SeShutdownPrivilege 832 explorer.exe Token: SeCreatePagefilePrivilege 832 explorer.exe Token: SeShutdownPrivilege 832 explorer.exe Token: SeCreatePagefilePrivilege 832 explorer.exe Token: SeShutdownPrivilege 832 explorer.exe Token: SeCreatePagefilePrivilege 832 explorer.exe Token: SeShutdownPrivilege 832 explorer.exe Token: SeCreatePagefilePrivilege 832 explorer.exe Token: SeShutdownPrivilege 832 explorer.exe Token: SeCreatePagefilePrivilege 832 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3948 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe - Suspicious use of SendNotifyMessage 56 IoCs
pid Process 3948 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 832 explorer.exe 832 explorer.exe 1872 SearchHost.exe 6100 StartMenuExperienceHost.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3948 wrote to memory of 4496 3948 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 88 PID 3948 wrote to memory of 5596 3948 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 91 PID 5596 wrote to memory of 2216 5596 cmd.exe 93 PID 5596 wrote to memory of 556 5596 cmd.exe 94 PID 3948 wrote to memory of 4500 3948 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 95 PID 3948 wrote to memory of 5972 3948 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 97 PID 3948 wrote to memory of 576 3948 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 99 PID 3948 wrote to memory of 1904 3948 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 100 PID 3948 wrote to memory of 832 3948 2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_b9d9bede0473f36155039d43e4db39ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "2⤵
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:2216
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:556
-
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:4500
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:5972
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:576
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:1904
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:832
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6100
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1872
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\ExplorerPatcher\WebView2Loader.dll
- Size 155KB
- SHA256 bb5fda5f2d3aae5e0977ab28d8a8a00acfd63d73748aaac32daf4fc6645b6677
- MD5 6d025364f66d8c2dcd882eaa3df83835
- SHA1 92ea55b6f46676c3b4a684fee5d7c1ed4e2e8772
- SHA512 d62f52c0aa0e54c6505e9a74e92424f378e40405ac4a383d9b6cf2cbee02b24187c72fb7436841a1ca249970e5ae60a703d1b85ad40a17aa66cd9a231ba04e17
- SSDEEP 3072:17+r33Gx3Xe/uy0A4BBnkDC49KMNU9eAT8uEtJjvv8WD73pe:1wnGV4p4BnkDCEKXEtJwmM
- TLSH T125F35C57B3E90077E17BC278C9634A45E772B8115B609AEF03A4467A1F237D0AE3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\en-US\pnidui.dll.mui
- Size 7KB
- SHA256 ae0d2655cb9806b5c16b92f82d698f5c98feaef1f78ebdd6014dccc8304184ed
- MD5 2ad025b8134ba57ff2bf8fadc8c09b41
- SHA1 4e741e5f0bec8c27cf732ba1be743fb243829e7f
- SHA512 fe20e5e6b9dd233b6361b5fc8d1aed3b4ce80f81b5c113e8c242d0c89d3c127013ba28dc650b24535aa43b85f4a2c0f9a82ae9b6c12dd0be55683329cc92aa00
- SSDEEP 96:rjJnlkt+jW52ujTJeEggdh4W43WR5c2g3WLoRzskKp1ExEWkhWw0E:/bkt+8jPeskKdWkhWg
- TLSH T169F1120263FA0509F0F36F3059FB62544F7ABC6279B6CA6E8780505E1CB0A549E60BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_gui.dll
- Size 831KB
- SHA256 d5ab64edbeb47771bad4dcd75bc119294e3d7d0a909436e991e2e143b300140e
- MD5 02166d2f7e0fbecd5492466e8aebcd73
- SHA1 005072cbfba3703ddde2f467f9ee40e6480cc76e
- SHA512 8f843c43d5e16aa3794bdf1cce6b724374b3b8371a51385c6418ca4e464b8bac5889b530c76c0f68fe1da1895aa9c39f2147dca4e37eabcf00ee6fbc22cb7bd5
- SSDEEP 6144:gBp1aeZDmEB24h8omXZsTfnzQPSz3l2pDgAGL7znZl/0mE8nc3TnR6UNdLpm:gBjaeY+24h8o6sUgCLm
- TLSH T194053C056BFB0118F6F3AF756DB552824A7BBDA6AE38C48E0244514D0D36FA0D9B4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_taskbar.ge.dll
- Size 2.6MB
- SHA256 fe0acb874c0f57412be05d33ca2d1d266767741ebc3823907cf1dbee89c39ab9
- MD5 104d9c85206cf56df2fe9f9ba763a412
- SHA1 9c59df82075bb1538b38857b3f299399123f5e3b
- SHA512 439199845b0eebbce160e13ef29c530ad1e1a3e12e6fe62896aac4eb2f441d70658b8a9535263cfc85fbb12c82798a29c888f136e4d5bfacf57957edac8f33b1
- SSDEEP 49152:KFX6aRvm5piyqZo5eGKJslcsNGAhx9DG1oQDo:wgGCWsPN+D
- TLSH T1E3C5060272F94198E0F3D778C9B78655DA327CA61932C68F26A0775E1F33B518E78722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host.dll
- Size 242KB
- SHA256 3d4f38e43d2153bb5da44825340900a814a7928644637d1ab1809eaaa0842a5e
- MD5 6a09651ede53dc61aebec136abe0e575
- SHA1 5d42aa0f7d0dbaa37b64455159d0be742deb1eb6
- SHA512 85d8e7e2c94bd733437f5deb50a0b746cab16df9c39b1588df0b2b86570552cc1026ac876064766f66bcb27ec36c7ff4d3923037a5d719f46bda10997049c2f7
- SSDEEP 3072:rqeAqGfYQej0qwPP1+YCflwUnMlKiD/FpargdG3km+Cm7S9kEXB9aosTQ75+7Rw:riYhEgpFub3oKq5OR
- TLSH T10F34174477E50569FAB76B389AB35546D633BC526B30CBDF02A4420D9F27BC09839B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
- Size 107KB
- SHA256 b78defcd7af6bc912031f013f1257dc32ce9b0b7bc1e4f16bb057988e7be7e8c
- MD5 09e0a447f72325fbcbc0de12b4bac868
- SHA1 336d5aef339fb28e89d7554879eee9948cd08bea
- SHA512 e6e9fc73baf757a28057ba773b57c4d54691f7e6714e40cbd013253955003b01ee403a4e38635f3e0e3387e1e75df41831e25204dd08cb35f6ca9b26af2ef76b
- SSDEEP 3072:hM8lNaxkYbVKe9124fx6LvLVbZaZaZ8XWTwcsezYQIX:RaxfbMcTfx6rowzeX
- TLSH T1D6B3494BA3E900BBE172967884930A45D772BC0117629FEF03A4521E5F337D59E3AFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\pnidui.dll
- Size 2.0MB
- SHA256 52e9c88cb50ef98e683839ab62880180f0dd3db3e1c445ea461ae63d97a349d3
- MD5 2f913bfdcf1fa8dc441aa48b508b3a09
- SHA1 6a832e3d222698aaf7b1176438387eb25a47432a
- SHA512 8b0c0ce642de3a86f0d1b2c50989e15de5f53d1a6eacc69bc69b2dd4f617bc62e1464602ad22282674a0385f0dfc85dd8eb03041b7ff6c5a9af13afd46a570f9
- SSDEEP 12288:07b3ZyzzfW8ZDhJ8wfm24wx8Zc0dDshhv9FrsEC:wZyzzf9DD/e24wx8qKsX9h
- TLSH T19EA5531D7767C056E0156A7C9CAFC1F85E12FC25DE2091DBB290BB3F3973A88B426684
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
- Size 1KB
- SHA256 fd7eafbebddef4e98134b303a57d9e1b70b9a6574840da54c72bcf1bcc716b66
- MD5 566d55fb832d885b34e9315f26f2b0ba
- SHA1 47256bd9f5f8b04adda97babf67a7ffcdae4869e
- SHA512 380fdabd19042bdb1ef8674f8ba3810d15a0cfec42ca9b22bc1cfda4bb9685c95d237b864e27e055ba07668cbbfd5a412034d07bc0f38337fdc2f0e7d1477fda
- TLSH T181418E1A23D1A714D736C9367C7BE72582B2FC06E952CF69488962C41C25100F839E6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartDocked.pdb
- Size 19.2MB
- SHA256 f3ae7a839a71d71777e73dcef2c746e50de817f7fc55b693f442921db8f50672
- MD5 ac6b6d7ad98c42d848df73cc0e7c5006
- SHA1 53f82a5fea00734f9d32b3871a4a8fcca9da8d3e
- SHA512 2093c8f4f4e67422a2e81968678084fab699f90de0f49f33c93bf47eb968c1fa4d1a3716f2d6901210ade62a71c1b3f4dac8c0df328406df75e392a0f60dc76f
- SSDEEP 49152:6mdWc7jxfK1k009VS2UZB4ErL0PK2kyvlWPfGkq6kvxh2yX3N3F3O3N3n3LeO6Q3:OSkPsOG6
- TLSH T1CE17B42071F665F7F2BE073741C6434C1A7051D357A289EB992433542EBB281DBAB2BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartUI.pdb
- Size 34.0MB
- SHA256 7bf15ec5f19f0b2d35149ddf642ea08e528b178e2c7145982e5a8a8a1f5ddddf
- MD5 e102eddea71961b0d4af9bec446ece07
- SHA1 fd4cfbe1216a70d4610367f292fa11aa350c8040
- SHA512 d17274c4beadc23bf67e1878a30194d99c3e4ca707f51e6072d3f7e7432da12d96d7ede4d23be08576b8ac764610aff27683ed4046e1b2bf41de84066ef149b9
- SSDEEP 196608:vPcF1Vbv8dJ6EPigdurTKKR68aMfUDCaN4QlkqYGxR2rlP9rKoyEXv/uIqvLzfHg:00joJ
- TLSH T17177D619716762B7E1BB0B7B4DC64309137151A357E38DAB192132342CBB341AB8F6BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\explorer.pdb
- Size 2.9MB
- SHA256 d1a3b2eae2fe59758dae319da8d274b25a288ebca63b26ccb4fd8d1f2a27d114
- MD5 7ae13d4f0144d0c91aed5f37a7d49b64
- SHA1 4fc85c1e0ad8ed30efb9e52fc39c77036c2e1d47
- SHA512 5d5ba4118df535020947fc5cb247d237663d236bdb2ce86b3d58502784b017576ebc16a594ab6959a22aa595a3df6361a965d53540382ba42452b4c391b5de1e
- SSDEEP 49152:GISzUWGT1gV544+MfutyEoZ5eNmklItrv:GIEThR3Z
- TLSH T162E5295273E750A1CA3F17B2A0178389EBB69953239187EB3C2673A21CC3142EF5F655
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
- Size 27.4MB
- SHA256 7a74f35cd9d0069325463b918e9cd6272bf1563608202d99a21742dedabb1d45
- MD5 476cfdaa7da7a868cac3fcb1a3bcc718
- SHA1 740b3434f0ae9f581787fa4fe23513b9bcd065cd
- SHA512 f74b02f59a67d21a4cd1567b33e9d53f7dabf50554865f594c04e8e40399b22bfc274739e22bb7213270c21729474e0d8761cc71beb1257476af1b59b74cc473
- SSDEEP 49152:sGDBmCileB++IGHaJ84trubfLVY5UL86TJUXysPGVzlGWcuJdSmV5odM/YJWVliW:ACiy+dG5GigUgjSMVgF
- TLSH T13A570A6373BF10A1D9BF6337818757996BB6425356C2C66B253633229CC72878B8B34C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll
- Size 8.3MB
- SHA256 715b75b289dd2efc34fb0ffd924fcd38a34fee9fc5e93a207fcada7cb38f6508
- MD5 20b55d5c6dce22f8011906281e4e6999
- SHA1 27735ead648e104d3715dabfcfff410cdcfc706c
- SHA512 87ce3569c9803380f31638c181f5c9d3bd1bba497d162405ef0d0271abef1fc91badaaeb8d79c30f8ee0f5313bf8dda161bec7de0a57e1f4bf10fcabb3d28db2
- SSDEEP 49152:mcvhib+lfmq53jlhFdDRqzVUW+qn47Y1sqjQ7y9GVshaTBLHiNLbEr1zIcmQn9aD:mCjdCQ1zIWx5KDegEgHnrQV
- TLSH T18F96395D15AC0A91E0ABA8BD88F31A0BF9713D9A9770C6C7447443741F2B3F6987E392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll
- Size 602KB
- SHA256 6f08ef0c85c380475090d797e01d96fe40ae2b13f58f9fee47b839cc67f01cbd
- MD5 d06fb96967957321c1e087f360d699e1
- SHA1 2a2832769dfeea1bbeeacce21ad1bf575db67b3d
- SHA512 17c1558081f36dc8424bf0af5bca76a20fdde5cfc90d3e5128abfbfef55e0b80c68b819b2588a67aa77befdbb90de1a5a85c4fe5997f087b4eaa71e7b0b08f02
- SSDEEP 12288:8CxFg90E40+QlkAkwORRnLVmb1oCQx9J2dqQNRzb7PrHn:JmH4JHAkwiRnpmb1oCQiBtb7
- TLSH T1A4D47D12A3F501B9E4BBC674CA674622FA727C551B20DADF4390895D2F337909B3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.DLL
- Size 167KB
- SHA256 c1702f0c036d21baf7e23d26a534621b28b0530ab2ded8080b5b2dcfaa88adec
- MD5 4d1b9cd6d9c54944e82b77e7caeaa13c
- SHA1 d3bda8c9ff75c305b692ebe726ca08014a10fada
- SHA512 26be877367c89664c2cbe602f8414cd9393974f3758b02213d63e01c45e2dd7162d9e5a7b6f1afa4fa1def1d49290ca66d8d9cb500786d8ee3491333eb75f095
- SSDEEP 3072:CcOkQjjyJxgroPXk2bAWZSApt+QXkA6oq0zeM:ojaackUvZJ+o
- TLSH T179F3F80372F918AFE0B386764AE352155A7678100B52EBEF425406562E633D1EE3DFB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\dxgi.dll
- Size 602KB
- SHA256 f9fe28783a1c262e6a5a66f6d55c81339a3c3ec17744f47bba7c8003f1108649
- MD5 fbd88070e2b07c30852b0a03613f6333
- SHA1 c08e551e25684abf7437d8e6a4fb2815510687c0
- SHA512 4cdbc9ca6673463cbb5dcf6df73d75048a120f3716d88f7044f7ca062fdef97f6a7dc97e3353995293b44043b6689b5250905ffe8a9a755859578e2ee71f72c5
- SSDEEP 12288:ZCxFg90E40+QlkAkwORRnLVmb1oCQx9J2dqQNRzb7PrHn:smH4JHAkwiRnpmb1oCQiBtb7
- TLSH T126D47D12A3F501B9E4BBC674CA674622FA727C551B20DADF4390895D2F337909B3E722
- MD5 SHA1 SHA512 SSDEEP TLSH