Analysis
- user interaction
yes - max time kernel
80s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ep_setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target ep_setup.exe
- Size 11.7MB
- Sample260710-e36w6set5y
- SHA256 8146db4d3a87201fb80ad1d3712ba8f56883e9a0811758bd39f62d73a9f2c586
- MD5 a611f07c3b935ef80361cb326a6c659d
- SHA1 660c5bb132cd03822b2982ad53cd1d1aee801a13
- SHA512 e8c21dc4a746c50cf14fdead54a37d8d77b40ae6276118bb2797039ca9b741dc519521c3264283b4e31dc2af9448f6c0a60bf25fc7b4a40ba5d9b7f309074a07
- SSDEEP 196608:LAvKGmJYCEKfMhjfGptv0jikRUEiyi5o2ItCC2bO+WxNtTYne/C5YbM1Vd+2AB5V:EKXOCEti4jikiEZijTCIKNtUnwYYA1K
- TLSH T118C633257BE209CEFA3BC37898B3110691A97D076B35D8BF9650059E4D33BE2C538729
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 9 IoCs
pid Process 5276 regsvr32.exe 5276 regsvr32.exe 1288 regsvr32.exe 5692 explorer.exe 5692 explorer.exe 4380 StartMenuExperienceHost.exe 4380 StartMenuExperienceHost.exe 5692 explorer.exe 4464 rundll32.exe - Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini explorer.exe File opened for modification C:\Users\Public\desktop.ini explorer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini explorer.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in Program Files directory 20 IoCs
description ioc Process File created C:\Program Files\ExplorerPatcher\Windows.UI.ShellCommon.pri ep_setup.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote71x71.png ep_setup.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\SkypeUISymbol-Regular.ttf ep_setup.exe File created C:\Program Files\ExplorerPatcher\ep_starttiledata.dll ep_setup.exe File created C:\Program Files\ExplorerPatcher\ep_setup.exe ep_setup.exe File created C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll ep_setup.exe File created C:\Program Files\ExplorerPatcher\ep_gui.dll ep_setup.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub71x71.png ep_setup.exe File created C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll ep_setup.exe File created C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll ep_setup.exe File created C:\Program Files\ExplorerPatcher\en-US\pnidui.dll.mui ep_setup.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub150x150.png ep_setup.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote150x150.png ep_setup.exe File created C:\Program Files\ExplorerPatcher\ep_dwm_svc.exe ep_setup.exe File created C:\Program Files\ExplorerPatcher\ep_weather_host.dll ep_setup.exe File created C:\Program Files\ExplorerPatcher\WebView2Loader.dll ep_setup.exe File created C:\Program Files\ExplorerPatcher\pnidui.dll ep_setup.exe File created C:\Program Files\ExplorerPatcher\pris\Windows.UI.ShellCommon.en-US.pri ep_setup.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\BitMDL2.ttf ep_setup.exe File created C:\Program Files\ExplorerPatcher\ep_taskbar.ge.dll ep_setup.exe - Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\dxgi.dll ep_setup.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll ep_setup.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll ep_setup.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib_orig.dll ep_setup.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll ep_setup.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll ep_setup.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\dxgi.dll ep_setup.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4280 sc.exe 5544 sc.exe 808 sc.exe 2980 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe - Kills process with taskkill 1 IoCs
pid Process 3436 taskkill.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\IconStreams = 14000000070000000100010003000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a2c000000000000002000000ea0707004100720067006a00620065007800200033000a005600610067007200650061007200670020006e0070007000720066006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000074ae2078e323294282c1e41cb67d5b9c0000000000000000000000000cdfc4b42410dd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000ea0707004100620020004e00680071007600620020004200680067006300680067002000510072006900760070007200200076006600200076006100660067006e0079007900720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000200000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000084f41b62410dd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000007b0031004e005000310034005200370037002d0030003200520037002d0034005200350051002d004f003700340034002d00320052004f0031004e00520035003100390038004f0037007d005c0046007200700068006500760067006c00550072006e0079006700750046006c006600670065006e006c002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000ea0707004a0076006100710062006a006600200046007200700068006500760067006c0020002d0020004e0070006700760062006100660020006100720072007100720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000dce282ba05f4ad47b032cf0faa0e3933000000000000000000000000231f40b42410dd0100000000000000000000000000000d20218f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32\ = "C:\\Program Files\\ExplorerPatcher\\ep_weather_host_stub.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\NumMethods regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\IconStreams = 14000000070000000100010003000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a2c000000000000002000000ea0707004100720067006a00620065007800200033000a005600610067007200650061007200670020006e0070007000720066006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c0000000000000000000000000cdfc4b42410dd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000ea0707004100620020004e00680071007600620020004200680067006300680067002000510072006900760070007200200076006600200076006100660067006e0079007900720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000084f41b62410dd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000007b0031004e005000310034005200370037002d0030003200520037002d0034005200350051002d004f003700340034002d00320052004f0031004e00520035003100390038004f0037007d005c0046007200700068006500760067006c00550072006e0079006700750046006c006600670065006e006c002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000ea0707004a0076006100710062006a006600200046007200700068006500760067006c0020002d0020004e0070006700760062006100660020006100720072007100720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000dce282ba05f4ad47b032cf0faa0e3933000000000000000000000000231f40b42410dd0100000000000000000000000000000d20218f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ = "PSFactoryBuffer" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{AACA7238-B532-4C0F-A923-8B6D12FD665D} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Interface regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\ = "ExplorerPatcher Weather Host" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PromotedIconCache = "{7820NR73-23R3-4229-82P1-R41PO67Q5O9P}" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ProxyStubClsid32\ = "{CDBF3734-F847-4F1B-B953-A605434DC1E7}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\AppID = "{A6EA9C2D-4982-4827-9204-0AC532959F6D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\DllSurrogate regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\NumMethods\ = "28" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ = "IEPWeather" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{3976F024-5AE1-4845-A43A-2C0C483307AC} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\UserStartTime = "134281313682289218" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32\ = "C:\\Program Files\\ExplorerPatcher\\ep_weather_host.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PastIconsStream = 1400000005000000010001000100000014000000494c200601000400040010001000ffffffff2100ffffffffffffffff424d3600000000000000360000002800000010000000400000000100200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010320141067af2a24daff2a24daff2a24daff141067af010103200000000000000000000000000000000000000000000000000000000000000000010103202520beef3732dcff2a24daff2a24daff2a24daff3732dcff2520beef010103200000000000000000000000000000000000000060000000ff00000000141067af3732dcfffefefeff7a76e8ff2a24daff7a76e8fffefefeff3732dcff141067af00000000000000000000000000000060000000ff000000ff000000002a24daff2a24daff7a76e8fffefefeff7a76e8fffefefeff7a76e8ff2a24daff2a24daff000000000000000000000060000000ff00000060000000ff000000002a24daff2a24daff2a24daff7a76e8fffefefeff7a76e8ff2a24daff2a24daff2a24daff000000ff000000ff000000ff0000006000000000000000ff000000002a24daff2a24daff7a76e8fffefefeff7a76e8fffefefeff7a76e8ff2a24daff2a24daff000000ff00000000000000000000000000000000000000ff00000000141067af3732dcfffefefeff7a76e8ff2a24daff7a76e8fffefefeff3732dcff141067af000000ff00000000000000000000000000000000000000ff00000000010103202520beef3732dcff2a24daff2a24daff2a24daff3732dcff2520beef01010320000000ff00000000000000000000000000000000000000ff000000000000000001010320141067af2a24daff2a24daff2a24daff141067af0101032000000000000000ff00000000000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff0000006000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000fe000000f2000000e2000000c20000000a0000007a0000007a0000007b0100007bff00000bff0000c3ff0000e3ff0000f3ff0000ffff0000ffff0000010000000800000003000000040000002c000000010000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PastIconsStream = 1400000005000000010001000200000014000000494c200602000c00040010001000ffffffff2100ffffffffffffffff424d3600000000000000360000002800000010000000c0000000010020000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff00000000000000ff00000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000c00000000100010000000000000300000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff000001000000080000000400000004000000340000000100000000000000010000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D} regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\ = "ExplorerPatcher Weather Host" regsvr32.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5692 explorer.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5692 explorer.exe 5692 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5692 explorer.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 3436 taskkill.exe Token: 35 4420 ep_setup.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe Token: SeShutdownPrivilege 5692 explorer.exe Token: SeCreatePagefilePrivilege 5692 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4420 ep_setup.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 4380 StartMenuExperienceHost.exe 5692 explorer.exe 5692 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4420 ep_setup.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5692 explorer.exe 5692 explorer.exe 4380 StartMenuExperienceHost.exe 5116 SearchHost.exe 5692 explorer.exe 5692 explorer.exe 5692 explorer.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4420 wrote to memory of 3436 4420 ep_setup.exe 86 PID 4420 wrote to memory of 4628 4420 ep_setup.exe 89 PID 4628 wrote to memory of 808 4628 cmd.exe 91 PID 4628 wrote to memory of 2980 4628 cmd.exe 92 PID 4420 wrote to memory of 4280 4420 ep_setup.exe 93 PID 4420 wrote to memory of 5544 4420 ep_setup.exe 95 PID 4420 wrote to memory of 5276 4420 ep_setup.exe 97 PID 4420 wrote to memory of 1288 4420 ep_setup.exe 98 PID 4420 wrote to memory of 5692 4420 ep_setup.exe 99 PID 5692 wrote to memory of 4464 5692 explorer.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ep_setup.exe"C:\Users\Admin\AppData\Local\Temp\ep_setup.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3436
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "2⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:808
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:2980
-
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:4280
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:5544
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:5276
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:1288
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Program Files\ExplorerPatcher\ep_gui.dll",ZZGUI3⤵
- Loads dropped DLL
PID:4464
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5116
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4380
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4576
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\BitMDL2.ttf
- Size 4KB
- SHA256 54c6d49b8f5b28abb78b35c21e39f3c40997450d462246599bdde44782ac754e
- MD5 47edfb34aa1d759aa24ab417f1723725
- SHA1 460ded5841c518d900f690b4222bfe0c3d48bfac
- SHA512 10a167aa25376f04ea600b61ad374ad84641205ea381cb1372800e593680135e9bbc1c0a773eda06ac68148c5d969e62af6816a77302c52746f715a67b31cdbc
- SSDEEP 96:Szb3zrXjrLaiL94z8C6ktlOEknTJOOY8NIBKYzzsnxiZbxS/:SzrHzrOB8C1IdxiNxY
- TLSH T1C0A15110E3FE8808F5BB2B3459F5173906B9FC4067BAD35E1258421DA934EA19E30777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\WebView2Loader.dll
- Size 155KB
- SHA256 bb5fda5f2d3aae5e0977ab28d8a8a00acfd63d73748aaac32daf4fc6645b6677
- MD5 6d025364f66d8c2dcd882eaa3df83835
- SHA1 92ea55b6f46676c3b4a684fee5d7c1ed4e2e8772
- SHA512 d62f52c0aa0e54c6505e9a74e92424f378e40405ac4a383d9b6cf2cbee02b24187c72fb7436841a1ca249970e5ae60a703d1b85ad40a17aa66cd9a231ba04e17
- SSDEEP 3072:17+r33Gx3Xe/uy0A4BBnkDC49KMNU9eAT8uEtJjvv8WD73pe:1wnGV4p4BnkDCEKXEtJwmM
- TLSH T125F35C57B3E90077E17BC278C9634A45E772B8115B609AEF03A4467A1F237D0AE3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\Windows.UI.ShellCommon.pri
- Size 2.8MB
- SHA256 bd15c1c4f88eedfc86dea1e1692f84ac37638694858d11c02b22705945d1330e
- MD5 b5edf00a3ad977e6587cfead07d22726
- SHA1 beb46626c5b8ad2a8426b8482a0c68f9dc09298d
- SHA512 48fe5df7932a0a10c21d69571bb5c6423ed052635fbdd6a640c73e032b84bb06a8c1321d539a8adbe0fd56dbc4145f550da9840d57bbdcbde6784a6c2f3d0b2d
- SSDEEP 24576:sQIx3Fyi5T+bi/Lkhai/LkhdxQe/khY+iNO+WPqsGu4udw8Y8QUVQxK3itG4BWO6:sQIx3F+gW1u+QEitG4mfy+v1R
- TLSH T1CFD56002B7FA4208F2F39FB56DBAC5751876BD225D21E16E10943E1F2972F409AA1733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\en-US\pnidui.dll.mui
- Size 7KB
- SHA256 ae0d2655cb9806b5c16b92f82d698f5c98feaef1f78ebdd6014dccc8304184ed
- MD5 2ad025b8134ba57ff2bf8fadc8c09b41
- SHA1 4e741e5f0bec8c27cf732ba1be743fb243829e7f
- SHA512 fe20e5e6b9dd233b6361b5fc8d1aed3b4ce80f81b5c113e8c242d0c89d3c127013ba28dc650b24535aa43b85f4a2c0f9a82ae9b6c12dd0be55683329cc92aa00
- SSDEEP 96:rjJnlkt+jW52ujTJeEggdh4W43WR5c2g3WLoRzskKp1ExEWkhWw0E:/bkt+8jPeskKdWkhWg
- TLSH T169F1120263FA0509F0F36F3059FB62544F7ABC6279B6CA6E8780505E1CB0A549E60BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_gui.dll
- Size 831KB
- SHA256 06ecc578cc39be55ecdb4834ca058e793b15390ad1abf085557fa9adc7af19da
- MD5 4cc9ef58dada8d8be80091cbdd94ba9c
- SHA1 148356366645212a970fe07ed43ccbaf1b5d17eb
- SHA512 f3101e399617ab3ff0b98b4bf35513f6a96b164b7b11635fe06352c1384f9ed02e3e4fca822c74cad788eac95ea66c39f0140d3fc6a4895419b3b2cb5bba6816
- SSDEEP 6144:X8HljrjYfF9+3YsOVeHp3t5PSz3l2pDgAGL7znZl/0mE8nc3TnR6UNdLp:X8HljwfF9+3FOWvgCL
- TLSH T1D0053C056BFB0118F6F3AF756DB552824A7BBDA6AE38C48E0244514D0D36FA0D9B4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_starttiledata.dll
- Size 148KB
- SHA256 e32f04e20fab299ac418d8064ebbec429996782aa03b4fc03a96987401c79859
- MD5 1fc5834cc89ce12c36b37506e8c1a623
- SHA1 26ddf3ace835ab9ce26aa08bfd8b675581f6bb0f
- SHA512 d99373bae0804e448084c0ed09efe940674f61329fffc9c841f4ba3272c69a4714297a0edea27d810169b1377e51e21d214fb566f9008b00bf9fdf86a6f6b464
- SSDEEP 3072:YEpK3u3Nt1O1qmJSiPfz9aMNOSWVsEwZIUOLzZdmy1fUHfnJ:5Ae3ItPBaMNOSPDOHZBiHfnJ
- TLSH T1D7E36D27727401AAD13BD07C89975A06F7B279962720DBCF12A1427A2F277F1AD3E350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_taskbar.ge.dll
- Size 2.6MB
- SHA256 59f2c3d6aa14944d24fc34e0b40cc196c5fefd5140d16d628d02e4dd2ce5f6b2
- MD5 bba5a6b8d339b8ba5076ec30977fbbc4
- SHA1 b808897969e7e0f7b397987d7b880e911e76941c
- SHA512 2bec37c57b1b33f4382b689b17566aa21d063b15ad9db742b3e2b23f1ebe6a2625b4d7baa8d57a5dd9518e18c4ee3e6ccd4ab7e5c2f7a687e67d722d3b10de7e
- SSDEEP 49152:yqEvlLWl2mABE5dZlQcngsdR6271/wI7Do:3Q3cJdUI7D
- TLSH T16DC5170272F94198E0F7D778C9B78655DA327C921932C68F26A0775E1F33B618E78722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host.dll
- Size 242KB
- SHA256 137ecc2eddf713556d2cee3ed74723f7aefc2e893cc0210c37587cd787af53a7
- MD5 561e88d9128ed8fc272f25c6c91fb69a
- SHA1 a1679ed8b099a7f3842740d546d45104ec115495
- SHA512 b4626303fb02ec2d86d2bc31b00e155f9f9ef73a7070b79a7a3a41881f25b9ff2d4786acb565b4aab7301a1b6935d4d9420150c6d5ecb6d2993eb6b1e351247a
- SSDEEP 3072:YqeAqGfYQej0qwPP1+YCflwUnMlKiD/FpargdG3km+Cm7S9kEXB9aosoQ75+7Rw:YiYhEgpFub3oKD5OR
- TLSH T1E634184477E50569FAB76B389AB35546D633BC526B30CBDF02A4420D9F27BC09839B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
- Size 107KB
- SHA256 f656731409df123bc9edf67b5667bae6d88275a086f463835a11fff436287826
- MD5 b3e78e973df9f3383e27726656896f18
- SHA1 415e7b02511072d82765e8c01bc9d602dfc8654a
- SHA512 21e220f5b564faf2faf6338f6a17b0a88e057782e90cb5b9dd78afd9067f9b3c28f567f817c69483685635215ee10d970d781079395da9f3e04690939d237fe0
- SSDEEP 3072:nM8lNaxkYbVKe9124fx6LvLVbZaZaZ8XWTwcsegYQIX:PaxfbMcTfx6rowgeX
- TLSH T1E8B3494BA3E900BBE172967884930A45D772BC0117629FEF03A4521E5F337D59E3AFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\pnidui.dll
- Size 2.0MB
- SHA256 52e9c88cb50ef98e683839ab62880180f0dd3db3e1c445ea461ae63d97a349d3
- MD5 2f913bfdcf1fa8dc441aa48b508b3a09
- SHA1 6a832e3d222698aaf7b1176438387eb25a47432a
- SHA512 8b0c0ce642de3a86f0d1b2c50989e15de5f53d1a6eacc69bc69b2dd4f617bc62e1464602ad22282674a0385f0dfc85dd8eb03041b7ff6c5a9af13afd46a570f9
- SSDEEP 12288:07b3ZyzzfW8ZDhJ8wfm24wx8Zc0dDshhv9FrsEC:wZyzzf9DD/e24wx8qKsX9h
- TLSH T19EA5531D7767C056E0156A7C9CAFC1F85E12FC25DE2091DBB290BB3F3973A88B426684
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\pris\Windows.UI.ShellCommon.en-US.pri
- Size 183KB
- SHA256 48de9376e52993c66956edd30a58ec1f8ed58f4e9ae21ad2d1a739ad952ae1fc
- MD5 18af812e01a575418952acefbe232f0b
- SHA1 6672685b3eb8faf7dceef22a0c0866f66850eaef
- SHA512 8e4f736ede86c5b108ec9b9c693ee82ac8c2bbeb005e15b39a1777c67c81a7a6aa0cf633ba6a21fbd8e0bb566420eff23117a0ac6114020913be03fbd9d776a9
- SSDEEP 3072:M+Hus1m6HLzoyVgyAIYlXilvkp+qhEUmkqCZB1+5vGFk:M+TmqIy4IWhEUmkrSvGFk
- TLSH T1FD044B4BE0E50576FA97357B24C353828B314EA05373CB53D424524AB5E3352A7AB3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
- Size 1KB
- SHA256 3a436829c129f4eacc68aa5ef39f132dfb999494c048b7cf4878b73eab74df01
- MD5 89a6e99e2201e4da5737530f7dc4467c
- SHA1 b14d4843ca040c5c6a9946e5f3045d2aba5c3b32
- SHA512 1e6512001e65ade0b5a16e77d6f471df65a489328f0a78e043987569ddceca17adaaeeb461bc41406486cb30b83788532d18a98169903589cf90b45e88373906
- TLSH T17641DD0823D16314D772CA36BC6EE705A232FC0AE9228FBE04C562C52C35210FD75E6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 7030d7b0e9e8972e876a00fea052bea4c48539ed73747ddf29b04ab02d8fdf04
- MD5 48f98fff6a8e8557b663e7946577d442
- SHA1 60908dc3a0d481daacd31eb2e00e383876da9e0a
- SHA512 63469877998557dc127b375a5e68464b5dbca134372f7ab54a865f6d0222bffa2d6752a70bdcd7908e66250f2a5c84ea69cdc0eba395a76dbaa44d1edbc35e6e
- TLSH T17FF0DC53D3E25125E023023D88A61BD27A33DB596FC7262B4640AE6C3E3B3002F494BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ept49EF.tmp
- Size 19KB
- SHA256 2ab286c0564428e76d2d702ccfc7859cc92e3cb5e126d664be7f5d57a682bd3b
- MD5 919fb198cd960b1173f040158ea86a2e
- SHA1 c3e2d6212cfdcbca2f15122887eb607cc5874d71
- SHA512 83e88d891fb1baaf7850dd18e7208a3e9dc18cf72854a11eee95d009eece158ec24901b867223e7ab06ac4f404b0aca1a2c71ff686af8db159ffe60246c309cc
- SSDEEP 384:nXDMORWtiOc+paaYa3UeUsKbq3L0KvUe/:nXDMeWtRnpaaYa3UeUssX4
- TLSH T14E92DE787826F05BD2A2B7854123B542D3E1339A9CC6E8C4F8DC06812DBBE43C75AC87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartDocked.pdb
- Size 19.2MB
- SHA256 f3ae7a839a71d71777e73dcef2c746e50de817f7fc55b693f442921db8f50672
- MD5 ac6b6d7ad98c42d848df73cc0e7c5006
- SHA1 53f82a5fea00734f9d32b3871a4a8fcca9da8d3e
- SHA512 2093c8f4f4e67422a2e81968678084fab699f90de0f49f33c93bf47eb968c1fa4d1a3716f2d6901210ade62a71c1b3f4dac8c0df328406df75e392a0f60dc76f
- SSDEEP 49152:6mdWc7jxfK1k009VS2UZB4ErL0PK2kyvlWPfGkq6kvxh2yX3N3F3O3N3n3LeO6Q3:OSkPsOG6
- TLSH T1CE17B42071F665F7F2BE073741C6434C1A7051D357A289EB992433542EBB281DBAB2BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartUI.pdb
- Size 34.0MB
- SHA256 7bf15ec5f19f0b2d35149ddf642ea08e528b178e2c7145982e5a8a8a1f5ddddf
- MD5 e102eddea71961b0d4af9bec446ece07
- SHA1 fd4cfbe1216a70d4610367f292fa11aa350c8040
- SHA512 d17274c4beadc23bf67e1878a30194d99c3e4ca707f51e6072d3f7e7432da12d96d7ede4d23be08576b8ac764610aff27683ed4046e1b2bf41de84066ef149b9
- SSDEEP 196608:vPcF1Vbv8dJ6EPigdurTKKR68aMfUDCaN4QlkqYGxR2rlP9rKoyEXv/uIqvLzfHg:00joJ
- TLSH T17177D619716762B7E1BB0B7B4DC64309137151A357E38DAB192132342CBB341AB8F6BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\explorer.pdb
- Size 2.9MB
- SHA256 d1a3b2eae2fe59758dae319da8d274b25a288ebca63b26ccb4fd8d1f2a27d114
- MD5 7ae13d4f0144d0c91aed5f37a7d49b64
- SHA1 4fc85c1e0ad8ed30efb9e52fc39c77036c2e1d47
- SHA512 5d5ba4118df535020947fc5cb247d237663d236bdb2ce86b3d58502784b017576ebc16a594ab6959a22aa595a3df6361a965d53540382ba42452b4c391b5de1e
- SSDEEP 49152:GISzUWGT1gV544+MfutyEoZ5eNmklItrv:GIEThR3Z
- TLSH T162E5295273E750A1CA3F17B2A0178389EBB69953239187EB3C2673A21CC3142EF5F655
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
- Size 27.4MB
- SHA256 7a74f35cd9d0069325463b918e9cd6272bf1563608202d99a21742dedabb1d45
- MD5 476cfdaa7da7a868cac3fcb1a3bcc718
- SHA1 740b3434f0ae9f581787fa4fe23513b9bcd065cd
- SHA512 f74b02f59a67d21a4cd1567b33e9d53f7dabf50554865f594c04e8e40399b22bfc274739e22bb7213270c21729474e0d8761cc71beb1257476af1b59b74cc473
- SSDEEP 49152:sGDBmCileB++IGHaJ84trubfLVY5UL86TJUXysPGVzlGWcuJdSmV5odM/YJWVliW:ACiy+dG5GigUgjSMVgF
- TLSH T13A570A6373BF10A1D9BF6337818757996BB6425356C2C66B253633229CC72878B8B34C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll
- Size 1.4MB
- SHA256 3e81cecf171d697dbf08e97cdc0ed60158d6fb405e9897d54890cf20e35ef856
- MD5 0e65a0a661148077bc24602067ac3ff7
- SHA1 3916fa695ac13a61e60edfd39f2f8504a99feb62
- SHA512 780aecc25942fc32d5454dbc139cf02d738e474de2b66e47d1f92f2549e01b4f79a03480a0f16d407ae398b1f2b8f25854997384e59b4b98a8f7bf6400e475bd
- SSDEEP 24576:MOWQVo+MVJRgjgfRCZhnNa/a63jGr64rzAiGzJ6eNUVyJppR3:M+a+u34ZJNY3k98zJ7NUgJP
- TLSH T1CE6528AE558C49D5D8AFA17988F39A0AFB307C09479092CB443807786FAF3F5897E345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll
- Size 8.3MB
- SHA256 715b75b289dd2efc34fb0ffd924fcd38a34fee9fc5e93a207fcada7cb38f6508
- MD5 20b55d5c6dce22f8011906281e4e6999
- SHA1 27735ead648e104d3715dabfcfff410cdcfc706c
- SHA512 87ce3569c9803380f31638c181f5c9d3bd1bba497d162405ef0d0271abef1fc91badaaeb8d79c30f8ee0f5313bf8dda161bec7de0a57e1f4bf10fcabb3d28db2
- SSDEEP 49152:mcvhib+lfmq53jlhFdDRqzVUW+qn47Y1sqjQ7y9GVshaTBLHiNLbEr1zIcmQn9aD:mCjdCQ1zIWx5KDegEgHnrQV
- TLSH T18F96395D15AC0A91E0ABA8BD88F31A0BF9713D9A9770C6C7447443741F2B3F6987E392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll
- Size 590KB
- SHA256 2106313e78ef4ebe079fa648c1277a62794fe7b007389d92fbf6d0d23ef8fa37
- MD5 cd35c832096968bc231067ed07b4012b
- SHA1 b4a31cc027e584a1e4d8deb7be9e016afa6b79a6
- SHA512 698c59c9e15d04c9dfd8174bab983e6b5ad4432486a4f5659ff48bd67aeb110b317b9eb02c813a816abc0ddf2a1d51665d0488cb45d95ab93bc77e7eeaa253ff
- SSDEEP 12288:eyP1gTP0RRejAShO/ddkHa2CFEgxtUSgRQHmB:/9uPmRdv/ddkHa2CFRqiH
- TLSH T104D47D12A7F900B9F5BBC674CA634522EA727C461720DADF0390895D5F337A1973EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.DLL
- Size 167KB
- SHA256 84e799291362aec0cf6a929c4e797ce43dabc2c3836b6f2031b69f75f8574dad
- MD5 a299dd7be3455475ddec35f9e910ac9b
- SHA1 dc3508fe1551f57b27cd3596dfc0641a0aa5a991
- SHA512 8c9d99c8d8d4ef413b05c88d947cdcb0ba7117ac4fc7d360cf82d4fcf9fbadf30c6978736af585be8b526aa058079a95a2e458fb7365e3f6604e04b02a2e979a
- SSDEEP 3072:qcOkQjjyJxgroPXk2bAWZSApt+mXkA6oqRCeM:QjaackUvZJQo
- TLSH T1BFF3F80372F918AFE0B386764AE352155A7678100B52EBEF425406562E633D1EE3DFB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\dxgi.dll
- Size 590KB
- SHA256 70a7d2ce085dc0db96d00abf351e5e316572801f5d43648e2ad47fd66ba174cc
- MD5 ced49a7f0a466a1652bd01172df2b5a8
- SHA1 4eb49d34e593de5d05c44df3f762359752011fb7
- SHA512 6ccffcd77bebc01e5ae15d00a94a5d489c231e7f6232c971127b01f1d5871d769e11ddd951ad04b9d21a7fa9bc418e4ae29363b00d8b77d8a6f6cbeaa18073ab
- SSDEEP 12288:GyP1gTP0RRejAShO/ddkHa2CFEgxtUSgRQHmB:H9uPmRdv/ddkHa2CFRqiH
- TLSH T12DD47D12A7F900B9F5BBC674CA634522EA727C461720DADF0390895D5F337A1973EB22
- MD5 SHA1 SHA512 SSDEEP TLSH