Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 01:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CEREJA DO BOLO 1 (2).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
CEREJA DO BOLO 1 (2).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target CEREJA DO BOLO 1 (2).exe
- Size 11.5MB
- Sample260808-bexf2szvaw
- SHA256 8e3dd4f24f65234cfc2aaae7d84f2a9ebc167ab47cb50f4422d5974d44d5ffe7
- MD5 77d0a1aad0fb5f3d659361a7b1a792b8
- SHA1 ff27b5ffc9743ee0765207654a054dbf5859b016
- SHA512 560702d7901be4f980176078eccea01d5f37830c6ee22b78dc9b81bb6adacf8d6b6b8707b3b802aea9bda02d41eabe9e836a3223c1d3121e261394ed78491ecf
- SSDEEP 196608:OLtFxp1mkyKU4j4LU3V1bbDL0kRUEtyiJo2ItCC2bO+WxNtTYneoC5YbMWwh6VTV:8tREk+4j4Lw1bD4kiEkizTCIKNtUnDYk
- TLSH T18FC633257BD105CAF577C278D8B32046A1BA7E126734C87F9751068A8E33BE18D38B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 24 1144 explorer.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 8 IoCs
pid Process 3380 regsvr32.exe 3380 regsvr32.exe 1480 regsvr32.exe 1144 explorer.exe 1144 explorer.exe 1948 StartMenuExperienceHost.exe 1948 StartMenuExperienceHost.exe 1144 explorer.exe - Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote150x150.png CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote71x71.png CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\ep_weather_host.dll CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\pnidui.dll CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\en-US\pnidui.dll.mui CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\pris\Windows.UI.ShellCommon.en-US.pri CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub150x150.png CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\SkypeUISymbol-Regular.ttf CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\ep_setup.exe CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\ep_gui.dll CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\ep_taskbar.5.dll CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\Windows.UI.ShellCommon.pri CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\BitMDL2.ttf CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\ep_dwm_svc.exe CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\WebView2Loader.dll CEREJA DO BOLO 1 (2).exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub71x71.png CEREJA DO BOLO 1 (2).exe - Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll CEREJA DO BOLO 1 (2).exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib_orig.dll CEREJA DO BOLO 1 (2).exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll CEREJA DO BOLO 1 (2).exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll CEREJA DO BOLO 1 (2).exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\dxgi.dll CEREJA DO BOLO 1 (2).exe File created C:\Windows\dxgi.dll CEREJA DO BOLO 1 (2).exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll CEREJA DO BOLO 1 (2).exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1340 sc.exe 4584 sc.exe 4620 sc.exe 4404 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5664 cmd.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe - Kills process with taskkill 1 IoCs
pid Process 4648 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PastIconsStream = 1400000005000000010001000100000014000000494c200601000400040010001000ffffffff2100ffffffffffffffff424d3600000000000000360000002800000010000000400000000100200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010320141067af2a24daff2a24daff2a24daff141067af010103200000000000000000000000000000000000000000000000000000000000000000010103202520beef3732dcff2a24daff2a24daff2a24daff3732dcff2520beef010103200000000000000000000000000000000000000060000000ff00000000141067af3732dcfffefefeff7a76e8ff2a24daff7a76e8fffefefeff3732dcff141067af00000000000000000000000000000060000000ff000000ff000000002a24daff2a24daff7a76e8fffefefeff7a76e8fffefefeff7a76e8ff2a24daff2a24daff000000000000000000000060000000ff00000060000000ff000000002a24daff2a24daff2a24daff7a76e8fffefefeff7a76e8ff2a24daff2a24daff2a24daff000000ff000000ff000000ff0000006000000000000000ff000000002a24daff2a24daff7a76e8fffefefeff7a76e8fffefefeff7a76e8ff2a24daff2a24daff000000ff00000000000000000000000000000000000000ff00000000141067af3732dcfffefefeff7a76e8ff2a24daff7a76e8fffefefeff3732dcff141067af000000ff00000000000000000000000000000000000000ff00000000010103202520beef3732dcff2a24daff2a24daff2a24daff3732dcff2520beef01010320000000ff00000000000000000000000000000000000000ff000000000000000001010320141067af2a24daff2a24daff2a24daff141067af0101032000000000000000ff00000000000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff0000006000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000fe000000f2000000e2000000c20000000a0000007a0000007a0000007b0100007bff00000bff0000c3ff0000e3ff0000f3ff0000ffff0000ffff0000010000000800000003000000040000002c000000010000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32\ = "C:\\Program Files\\ExplorerPatcher\\ep_weather_host.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ProxyStubClsid32\ = "{CDBF3734-F847-4F1B-B953-A605434DC1E7}" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32\ = "C:\\Program Files\\ExplorerPatcher\\ep_weather_host_stub.dll" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Interface regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{EF373A81-C92C-4BC4-ACB7-DA72B3D9673B} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\ = "ExplorerPatcher Weather Host" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PastIconsStream = 1400000005000000010001000200000014000000494c200602000c00040010001000ffffffff2100ffffffffffffffff424d3600000000000000360000002800000010000000c0000000010020000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff00000000000000ff00000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000c00000000100010000000000000300000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff000001000000080000000400000004000000340000000100000000000000010000000000000000000000000000000000000000000000 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\ = "ExplorerPatcher Weather Host" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{5F0A37DE-07D7-43E4-BFA3-DDCDB7B47741} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\IconStreams = 14000000070000000100010003000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000094c000000000000002000000ea0708004100720067006a00620065007800200032000a005600610067007200650061007200670020006e0070007000720066006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c0000000000000000000000007d47a1e6d126dd016900630072006f000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a00660000004500780070005f006300770035006e00310068003200740078007900650077007900000043003a005c00570069006e0064006f00770073005c00530079007300740065006d0041007000700073005c004d006900630072006f0073006f0066007400570069006e0064006f00770073002e0043006c00690065006e0074002e0043006f00720065005f006300770035006e0031006800320074007800790065007700790000004d006900630072006f0073006f0066007400570069006e0064006f00770073002e0043006c00690065006e0074002e0043006f007200650000006300770035006e00310068003200740078007900650077007900000043004e003d004d006900630072006f0073006f00660074002000570069006e0064006f00770073002c0020004f003d004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002c0020004c003d005200650064006d006f006e0064002c00200053003d00570061007300680069006e00670074006f006e002c00200043003d005500530000004d006900630072006f0073006f0066007400570069006e0064006f00770073002e0043006c00690065006e0074002e0043006f00720065005f0031003000300030002e0032000000040000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000ea0708004100620020004e00680071007600620020004200680067006300680067002000510072006900760070007200200076006600200076006100660067006e0079007900720071002e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f20d0000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000ad94d6e7d126dd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a0066000000000000000000000000000000000000000000000000000000000000000000000000000f00000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000001e000000000000000a000000060000000f0000000000000000000000000000000000000000000000000000000000000000000000000000000000260400000000000000000000000000000000000000000f000000000000000000000000000000000000000000000000000000000000000f00000000000000d0d5270400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000000000000000000000000000000000000000000000000000000000007000000000000000000000000000000280000000000000002000000000000000f00000000000000000000000000000000000000000000000000000000000000000000000000000000fc250400000000000000000000000000000000000000000f000000000000000000000000000000000000000000000000000000000000000f00000000000000e0ca27040000000000000000000000000000000000000000000000000000000000000000050000007b0031004e005000310034005200370037002d0030003200520037002d0034005200350051002d004f003700340034002d00320052004f0031004e00520035003100390038004f0037007d005c0046007200700068006500760067006c00550072006e0079006700750046006c006600670065006e006c002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000ea0708004a0076006100710062006a006600200046007200700068006500760067006c0020002d0020004e0070006700760062006100660020006100720072007100720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000dce282ba05f4ad47b032cf0faa0e39330000000000000000000000007a9bd5e5d126dd0100000000000000000000000000000d20218f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ = "IEPWeather" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\NotificationData explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ = "PSFactoryBuffer" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\NumMethods\ = "28" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\UserStartTime = "134306246795825798" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PromotedIconCache = "{7820NR73-23R3-4229-82P1-R41PO67Q5O9P}" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\AppID = "{A6EA9C2D-4982-4827-9204-0AC532959F6D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\DllSurrogate regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1144 explorer.exe 1144 explorer.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 4648 taskkill.exe Token: 35 3332 CEREJA DO BOLO 1 (2).exe Token: SeShutdownPrivilege 1144 explorer.exe Token: SeCreatePagefilePrivilege 1144 explorer.exe Token: SeShutdownPrivilege 1144 explorer.exe Token: SeCreatePagefilePrivilege 1144 explorer.exe Token: SeShutdownPrivilege 1144 explorer.exe Token: SeCreatePagefilePrivilege 1144 explorer.exe Token: SeShutdownPrivilege 1144 explorer.exe Token: SeCreatePagefilePrivilege 1144 explorer.exe Token: SeShutdownPrivilege 1144 explorer.exe Token: SeCreatePagefilePrivilege 1144 explorer.exe Token: SeShutdownPrivilege 1144 explorer.exe Token: SeCreatePagefilePrivilege 1144 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3332 CEREJA DO BOLO 1 (2).exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe - Suspicious use of SendNotifyMessage 53 IoCs
pid Process 3332 CEREJA DO BOLO 1 (2).exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe 1144 explorer.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1144 explorer.exe 1144 explorer.exe 5552 SearchHost.exe 1948 StartMenuExperienceHost.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3332 wrote to memory of 4648 3332 CEREJA DO BOLO 1 (2).exe 90 PID 3332 wrote to memory of 5664 3332 CEREJA DO BOLO 1 (2).exe 92 PID 5664 wrote to memory of 1340 5664 cmd.exe 94 PID 5664 wrote to memory of 4584 5664 cmd.exe 95 PID 3332 wrote to memory of 4620 3332 CEREJA DO BOLO 1 (2).exe 96 PID 3332 wrote to memory of 4404 3332 CEREJA DO BOLO 1 (2).exe 98 PID 3332 wrote to memory of 3380 3332 CEREJA DO BOLO 1 (2).exe 100 PID 3332 wrote to memory of 1480 3332 CEREJA DO BOLO 1 (2).exe 101 PID 3332 wrote to memory of 1144 3332 CEREJA DO BOLO 1 (2).exe 102 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CEREJA DO BOLO 1 (2).exe"C:\Users\Admin\AppData\Local\Temp\CEREJA DO BOLO 1 (2).exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:1340
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:4584
-
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:4620
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:4404
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:3380
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:1480
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Downloads MZ/PE file
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1144
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5552
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1948
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\ExplorerPatcher\WebView2Loader.dll
- Size 155KB
- SHA256 ae26d6ef7c8f6b533585ead76318b6cbf8efad708064953a312dd97f4761ba45
- MD5 1723113a064ca8fca20bc36ec76772b0
- SHA1 f0ace56f45af1356968df164a975b7d7c1791131
- SHA512 47699a0ec1b6a8e98e707fecb484e8fd53db3daccb64897a6782fd48c4b6aca7805b045d15f0361a793c301004acfdf00655e1a449869514f96a1d81f7aa82fd
- SSDEEP 3072:cF1MwEX3tInKje5qX3HNuD9KPyBTJzNQG/BTeu3mEtJcKOx+4S37:cBA3mi6kuD9KPyBtnmEtJ1bHL
- TLSH T18DF34B57B2E80077E07BC278C5A34A46E77678151760AAEF0364477A1F237D0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\en-US\pnidui.dll.mui
- Size 7KB
- SHA256 ae0d2655cb9806b5c16b92f82d698f5c98feaef1f78ebdd6014dccc8304184ed
- MD5 2ad025b8134ba57ff2bf8fadc8c09b41
- SHA1 4e741e5f0bec8c27cf732ba1be743fb243829e7f
- SHA512 fe20e5e6b9dd233b6361b5fc8d1aed3b4ce80f81b5c113e8c242d0c89d3c127013ba28dc650b24535aa43b85f4a2c0f9a82ae9b6c12dd0be55683329cc92aa00
- SSDEEP 96:rjJnlkt+jW52ujTJeEggdh4W43WR5c2g3WLoRzskKp1ExEWkhWw0E:/bkt+8jPeskKdWkhWg
- TLSH T169F1120263FA0509F0F36F3059FB62544F7ABC6279B6CA6E8780505E1CB0A549E60BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_gui.dll
- Size 796KB
- SHA256 065111c4c6435a69a83f5d1e0f264879c9a2d7632d7298aeba56048f945e6f36
- MD5 ec14fcec508bbf29d9ab1f27d2508129
- SHA1 b8007aaca316371e53e23924b0ab2ddb8124d718
- SHA512 fe8f2203c06e5b547e48bc759178001286712c6c7861aedbb50dd47eaebac3120c3a3d0d71cd0d6095ca374bef6e67a66f6f3746b9318f0e572fa95288eb521e
- SSDEEP 6144:2iGEUSE5n24EZux5nxg1X8VRZzHaJWk2RGf7znZl/0mZsLx3TaZf+2Gsf:eEe5n24EIZNzEX
- TLSH T1E7053D1167FC0119F6F3AF356EB552924A7BBEA6AE38C08E0244554D0D72FA0DA74B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_taskbar.5.dll
- Size 2.4MB
- SHA256 96ab0d77bee8aa353ebcd2ac7c2884f6c9dd61a93e2cd6948cd8d9745ed2933e
- MD5 b331525697dfd956017f96f5cd794409
- SHA1 7f60ec45e553fe8ce386f166d71208287174bec5
- SHA512 4a18c8ae585c4385d88ab8853cf28508f69dec34da037e943aed3a952c92e8cf9a5559bb06e710466a3f87389ec22ad9d6db6763e4e9ae8915c35094dadec2a5
- SSDEEP 49152:jk2CxfmP+no2gMD/Bb6TxNEQ/adFIW013D:jk2wfEcQ/cI5D
- TLSH T1F4B55A4673F84098D0BAD27CC9BB8555EA727C961932C68F22A1775E1F337618E3D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host.dll
- Size 242KB
- SHA256 fb170dda4f77d291c92843469a279522f974817c1f6e468a37318414ec62c1b9
- MD5 f46edc78b8dc5f516c12104131f2f547
- SHA1 1dcb293a28a7cc02f15ef96ef8d137d6822082d4
- SHA512 e5a6588f724deccb1a8c697a0fb0a7ef2f16bf67224186fb2d0a9bb8364fa54abd5a731df1edd1f0b4c1ae2ac9f9f74a175ed03eaf126adf7b0771b9d9807ddc
- SSDEEP 3072:vtO0mbdQj5zm5YXtkh7LPuXFmk8am+Cm7S9kEXB9aosaLDCX/CWZIxl:vybO48mrEvDX//Ix
- TLSH T12034285477E5056CFAB76B398A7355469A37BC522B30CB9F02A4420D9F37B80983AF31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
- Size 107KB
- SHA256 1f071ed23f399c1bda4095866cab4d46786790f88eecab481bc59abd045bac91
- MD5 f6621c87c15ce7681cc4edf37377affd
- SHA1 2670138b3a38af1a2883f3f34ad1c52e36c8af08
- SHA512 b1fc0a8defea50f3c7e925cf38b6295d838ebb17f3836b61ba3495775be806a35d928bcfc533251d5cba2227fcab313134ce4c578f6e351c82486788629d7d3e
- SSDEEP 3072:Iat6iX72+Bb6AfqkUjXuLfAtpFrpqpqpvJG6/BHud43ZU:nt667f8SqkUj+KM2C
- TLSH T14BB3395BA7E600BBE1768539C4A70A05D772FC0147A19BEF43A4426A1F337D18E3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\pnidui.dll
- Size 2.0MB
- SHA256 52e9c88cb50ef98e683839ab62880180f0dd3db3e1c445ea461ae63d97a349d3
- MD5 2f913bfdcf1fa8dc441aa48b508b3a09
- SHA1 6a832e3d222698aaf7b1176438387eb25a47432a
- SHA512 8b0c0ce642de3a86f0d1b2c50989e15de5f53d1a6eacc69bc69b2dd4f617bc62e1464602ad22282674a0385f0dfc85dd8eb03041b7ff6c5a9af13afd46a570f9
- SSDEEP 12288:07b3ZyzzfW8ZDhJ8wfm24wx8Zc0dDshhv9FrsEC:wZyzzf9DD/e24wx8qKsX9h
- TLSH T19EA5531D7767C056E0156A7C9CAFC1F85E12FC25DE2091DBB290BB3F3973A88B426684
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
- Size 1KB
- SHA256 6384ca94278560093130748303fb721a750cc2e5be60b8256d78d6daa4505378
- MD5 76d6635c9c8cdfa889d069145ab43d21
- SHA1 a4909e2608d74d3ad9b77e21ea188a4e379dc99d
- SHA512 4bdde0ab13fc385668e4e6c50158ebfa50451d097c5a63b4f568a6bd66c19d905e560b4407d86bd07890857bf4e5d9237f48c2aab63587ee8172ee0d40ce4365
- TLSH T1A041B71963E16318D3778A326C7AE71682B3FC06E9228F3D45C852C62C29124F874E2F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartDocked.pdb
- Size 19.2MB
- SHA256 f3ae7a839a71d71777e73dcef2c746e50de817f7fc55b693f442921db8f50672
- MD5 ac6b6d7ad98c42d848df73cc0e7c5006
- SHA1 53f82a5fea00734f9d32b3871a4a8fcca9da8d3e
- SHA512 2093c8f4f4e67422a2e81968678084fab699f90de0f49f33c93bf47eb968c1fa4d1a3716f2d6901210ade62a71c1b3f4dac8c0df328406df75e392a0f60dc76f
- SSDEEP 49152:6mdWc7jxfK1k009VS2UZB4ErL0PK2kyvlWPfGkq6kvxh2yX3N3F3O3N3n3LeO6Q3:OSkPsOG6
- TLSH T1CE17B42071F665F7F2BE073741C6434C1A7051D357A289EB992433542EBB281DBAB2BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartUI.pdb
- Size 34.0MB
- SHA256 7bf15ec5f19f0b2d35149ddf642ea08e528b178e2c7145982e5a8a8a1f5ddddf
- MD5 e102eddea71961b0d4af9bec446ece07
- SHA1 fd4cfbe1216a70d4610367f292fa11aa350c8040
- SHA512 d17274c4beadc23bf67e1878a30194d99c3e4ca707f51e6072d3f7e7432da12d96d7ede4d23be08576b8ac764610aff27683ed4046e1b2bf41de84066ef149b9
- SSDEEP 196608:vPcF1Vbv8dJ6EPigdurTKKR68aMfUDCaN4QlkqYGxR2rlP9rKoyEXv/uIqvLzfHg:00joJ
- TLSH T17177D619716762B7E1BB0B7B4DC64309137151A357E38DAB192132342CBB341AB8F6BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\explorer.pdb
- Size 2.9MB
- SHA256 d1a3b2eae2fe59758dae319da8d274b25a288ebca63b26ccb4fd8d1f2a27d114
- MD5 7ae13d4f0144d0c91aed5f37a7d49b64
- SHA1 4fc85c1e0ad8ed30efb9e52fc39c77036c2e1d47
- SHA512 5d5ba4118df535020947fc5cb247d237663d236bdb2ce86b3d58502784b017576ebc16a594ab6959a22aa595a3df6361a965d53540382ba42452b4c391b5de1e
- SSDEEP 49152:GISzUWGT1gV544+MfutyEoZ5eNmklItrv:GIEThR3Z
- TLSH T162E5295273E750A1CA3F17B2A0178389EBB69953239187EB3C2673A21CC3142EF5F655
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll
- Size 8.3MB
- SHA256 715b75b289dd2efc34fb0ffd924fcd38a34fee9fc5e93a207fcada7cb38f6508
- MD5 20b55d5c6dce22f8011906281e4e6999
- SHA1 27735ead648e104d3715dabfcfff410cdcfc706c
- SHA512 87ce3569c9803380f31638c181f5c9d3bd1bba497d162405ef0d0271abef1fc91badaaeb8d79c30f8ee0f5313bf8dda161bec7de0a57e1f4bf10fcabb3d28db2
- SSDEEP 49152:mcvhib+lfmq53jlhFdDRqzVUW+qn47Y1sqjQ7y9GVshaTBLHiNLbEr1zIcmQn9aD:mCjdCQ1zIWx5KDegEgHnrQV
- TLSH T18F96395D15AC0A91E0ABA8BD88F31A0BF9713D9A9770C6C7447443741F2B3F6987E392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll
- Size 610KB
- SHA256 7fc085e586d7e461a5c3e3efd7f7e1c392cc7a384fccafb832117bff2cd1e249
- MD5 4c0cd564d448ea65dc253c402898ae01
- SHA1 4a1c322c7cd4da463d8be55811a1d9e0fc50cca7
- SHA512 d9135d9170d8f05d1c231cae977c5a2fed592d5535d0ad411dc72af6e5d101e7488cfded63adbd7517e1521a2af1b50143d19f655c7784955ddb4e4fe4c3a95e
- SSDEEP 12288:b67T/LbSb6OevG6p0utTVw0QCpr0U3tw/3:b6H/Lm2Oel0utTVRuU9wf
- TLSH T1D1D45D16B7E500A9E5BBC538CE674522FA727C5517249ADF03508A5E2F33BD04B3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.DLL
- Size 163KB
- SHA256 b376196022b58d3443811c6195f7c02bc9958ab04004f17b6602d55ceb05e4f1
- MD5 61e5a9f5c835814e74388f6bb9e38c1f
- SHA1 d28a3bd0d621e289af4bfc788b4408f93694aeae
- SHA512 7a0cf5318dc282cefdd01b202fe3341acdc27783d047894af267212387b3219e23718b645487c33f5bc5815f9cf49b936a7d327d23401853827d5221951a6202
- SSDEEP 3072:+mY5wnIXseI+TIbthiIVNuebmzWbn+eM:TIA+0B7mm
- TLSH T14FF3E90372F518AFE0F386324AE356155776BC100B52EF9F465406962E633A1AE2DFB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\dxgi.dll
- Size 610KB
- SHA256 4fbeb0c3f5ed552237789eac29bc14d3f68bb1a009247473b191cf78c863cbcb
- MD5 ee2c8605654eb22d3f28722b821517df
- SHA1 47435472ee2ffa3a2c3c73dd6f179efad5158473
- SHA512 79c2dc4710ac3812880648b6ef28330eba352f74ba1bb541efa6eed27537210f50eda1c9e41a40652ce46a574b1988dfd0a45162c22dd4eac811a4d68e6829f9
- SSDEEP 12288:J67T/LbSb6OevG6p0utTVw0QCpr0U3tw/3:J6H/Lm2Oel0utTVRuU9wf
- TLSH T1D0D45D16B7E500A9E5BBC538CE674522FA727C5517249ADF03508A5E2F33BD04B3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH