Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 04:24
Behavioral task
behavioral1
Sample
2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
35 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
General
- Target 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
- Size 13.0MB
- Sample260928-e1p6mswtf1
- SHA256 f479b013f79dddad9dca0e40871af497dd69ca63d699f7b3cf48b185ac2f9233
- MD5 76a9cb71e97f225d88c10d2c3d5b3ab4
- SHA1 643db7fc57496e212409f74f26a88c429f5fb5bb
- SHA512 c5b73f2eed33b87d9f0eb014ddeb27e5a1c54dcd7076f8e86f6a0e9f5edaaac47335f5575151e2a9b028886c3494783968dc18b011160e5feea9175a2e804af5
- SSDEEP 393216:RKXOCEti4jikiEZijTCIKNtUnwYYA1KnZW:7Ft9jLZ2WzcnwYYUL
- TLSH T167D633297BE2098EFA37D73898B3114791997D076B35D8AFD210049E4D33BE2C938769
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c529-368.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 28 4928 explorer.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 11 IoCs
pid Process 544 elevation_service.exe 4312 maintenanceservice.exe 6024 OSE.EXE 4412 PerceptionSimulationService.exe 5988 perfhost.exe 3096 ReFsDedupSvc.exe 3556 SensorDataService.exe 1652 ssh-agent.exe 3276 AgentService.exe 2712 SearchIndexer.exe 1120 elevation_service.exe - Loads dropped DLL 8 IoCs
pid Process 1988 regsvr32.exe 1988 regsvr32.exe 2940 regsvr32.exe 4928 explorer.exe 4928 explorer.exe 1488 StartMenuExperienceHost.exe 1488 StartMenuExperienceHost.exe 4928 explorer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 55 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe \??\E:\ explorer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe \??\F:\ 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe \??\F:\ explorer.exe \??\F:\ OSE.EXE File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe OSE.EXE File opened for modification C:\Windows\System32\msdtc.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\msiexec.exe OSE.EXE File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\SensorDataService.exe OSE.EXE File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe OSE.EXE File opened for modification C:\Windows\system32\msiexec.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe OSE.EXE File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe OSE.EXE File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe OSE.EXE File opened for modification C:\Windows\System32\vds.exe OSE.EXE File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe OSE.EXE File opened for modification C:\Windows\System32\ReFsDedupSvc.exe OSE.EXE File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe OSE.EXE File opened for modification C:\Windows\system32\TieringEngineService.exe OSE.EXE File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe OSE.EXE File opened for modification C:\Windows\System32\snmptrap.exe OSE.EXE File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe OSE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe -
resource yara_rule behavioral2/memory/1900-8-0x0000000140000000-0x000000014257A000-memory.dmp upx behavioral2/memory/1900-81-0x0000000140000000-0x000000014257A000-memory.dmp upx behavioral2/files/0x00010000000093af-367.dat upx behavioral2/files/0x0001000000009b92-377.dat upx behavioral2/files/0x000100000000a1d4-381.dat upx behavioral2/files/0x000100000000a319-385.dat upx behavioral2/memory/1900-429-0x0000000140000000-0x000000014257A000-memory.dmp upx behavioral2/files/0x000100000000a304-384.dat upx behavioral2/files/0x000100000000a2c1-383.dat upx behavioral2/files/0x000100000000a0ce-380.dat upx behavioral2/files/0x000100000000ba3d-379.dat upx behavioral2/files/0x0001000000006215-378.dat upx behavioral2/files/0x0001000000009371-382.dat upx behavioral2/files/0x0001000000009cfe-376.dat upx behavioral2/files/0x0001000000009cd6-375.dat upx behavioral2/files/0x000100000001b952-374.dat upx behavioral2/files/0x0001000000009952-372.dat upx behavioral2/files/0x0001000000009337-366.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\ExplorerPatcher\pnidui.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\WriteGet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_setup.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe OSE.EXE File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe OSE.EXE File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe OSE.EXE File created C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\BitMDL2.ttf 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File created C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe OSE.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe OSE.EXE File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File created C:\Program Files\ExplorerPatcher\ep_weather_host.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe OSE.EXE File opened for modification C:\Program Files\Internet Explorer\iexplore.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe OSE.EXE - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib_orig.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\dxgi.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe OSE.EXE File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File created C:\Windows\dxgi.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5912 sc.exe 2008 sc.exe 4324 sc.exe 3216 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1832 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Kills process with taskkill 1 IoCs
pid Process 3652 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000099f8d85d014fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069ca1d5d014fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e46a25d014fdd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a332b65d014fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000086e749a014fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000922d615e014fdd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6fc129a014fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000943a365d014fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{9415C9CC-1606-4E00-89EC-B5945E321BA4} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\DllSurrogate regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\NumMethods regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\UserStartTime = "134350430986235583" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\ = "ExplorerPatcher Weather Host" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\ = "ExplorerPatcher Weather Host" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ = "IEPWeather" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Interface regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PastIconsStream = 1400000005000000010001000200000014000000494c200602000c00040010001000ffffffff2100ffffffffffffffff424d3600000000000000360000002800000010000000c0000000010020000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff00000000000000ff00000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000c00000000100010000000000000300000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff000001000000080000000400000004000000340000000100000000000000010000000000000000000000000000000000000000000000 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32\ = "C:\\Program Files\\ExplorerPatcher\\ep_weather_host_stub.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PastIconsStream = 1400000005000000010001000100000014000000494c200601000400040010001000ffffffff2100ffffffffffffffff424d3600000000000000360000002800000010000000400000000100200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010320141067af2a24daff2a24daff2a24daff141067af010103200000000000000000000000000000000000000000000000000000000000000000010103202520beef3732dcff2a24daff2a24daff2a24daff3732dcff2520beef010103200000000000000000000000000000000000000060000000ff00000000141067af3732dcfffefefeff7a76e8ff2a24daff7a76e8fffefefeff3732dcff141067af00000000000000000000000000000060000000ff000000ff000000002a24daff2a24daff7a76e8fffefefeff7a76e8fffefefeff7a76e8ff2a24daff2a24daff000000000000000000000060000000ff00000060000000ff000000002a24daff2a24daff2a24daff7a76e8fffefefeff7a76e8ff2a24daff2a24daff2a24daff000000ff000000ff000000ff0000006000000000000000ff000000002a24daff2a24daff7a76e8fffefefeff7a76e8fffefefeff7a76e8ff2a24daff2a24daff000000ff00000000000000000000000000000000000000ff00000000141067af3732dcfffefefeff7a76e8ff2a24daff7a76e8fffefefeff3732dcff141067af000000ff00000000000000000000000000000000000000ff00000000010103202520beef3732dcff2a24daff2a24daff2a24daff3732dcff2520beef01010320000000ff00000000000000000000000000000000000000ff000000000000000001010320141067af2a24daff2a24daff2a24daff141067af0101032000000000000000ff00000000000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff0000006000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000fe000000f2000000e2000000c20000000a0000007a0000007a0000007b0100007bff00000bff0000c3ff0000e3ff0000f3ff0000ffff0000ffff0000010000000800000003000000040000002c000000010000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ = "PSFactoryBuffer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\NumMethods\ = "28" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PromotedIconCache = "{7820NR73-23R3-4229-82P1-R41PO67Q5O9P}" explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{D1F74690-397D-4F69-9F93-E094DDBB2797} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\IconStreams = 14000000070000000100010003000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090c100000000000002000000ea0709004100720067006a00620065007800200033000a005600610067007200650061007200670020006e0070007000720066006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000c9eb675c014fdd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000ea0709004100620020004e00680071007600620020004200680067006300680067002000510072006900760070007200200076006600200076006100660067006e0079007900720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000ae77b15c014fdd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000007b0031004e005000310034005200370037002d0030003200520037002d0034005200350051002d004f003700340034002d00320052004f0031004e00520035003100390038004f0037007d005c0046007200700068006500760067006c00550072006e0079006700750046006c006600670065006e006c002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000ea0709004a0076006100710062006a006600200046007200700068006500760067006c0020002d0020004e0070006700760062006100660020006100720072007100720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000dce282ba05f4ad47b032cf0faa0e39330000000000000000000000001fa70d5c014fdd0100000000000000000000000000000d20218f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\IconStreams = 14000000070000000100010003000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090c100000000000002000000ea0709004100720067006a00620065007800200033000a005600610067007200650061007200670020006e0070007000720066006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000c9eb675c014fdd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000ea0709004100620020004e00680071007600620020004200680067006300680067002000510072006900760070007200200076006600200076006100660067006e0079007900720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000200000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000fbec3360014fdd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000007b0031004e005000310034005200370037002d0030003200520037002d0034005200350051002d004f003700340034002d00320052004f0031004e00520035003100390038004f0037007d005c0046007200700068006500760067006c00550072006e0079006700750046006c006600670065006e006c002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000ea0709004a0076006100710062006a006600200046007200700068006500760067006c0020002d0020004e0070006700760062006100660020006100720072007100720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000dce282ba05f4ad47b032cf0faa0e39330000000000000000000000001fa70d5c014fdd0100000000000000000000000000000d20218f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32\ = "C:\\Program Files\\ExplorerPatcher\\ep_weather_host.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ProxyStubClsid32\ = "{CDBF3734-F847-4F1B-B953-A605434DC1E7}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\AppID = "{A6EA9C2D-4982-4827-9204-0AC532959F6D}" regsvr32.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4928 explorer.exe 4928 explorer.exe 544 elevation_service.exe 544 elevation_service.exe 544 elevation_service.exe 544 elevation_service.exe 544 elevation_service.exe 544 elevation_service.exe 544 elevation_service.exe 6024 OSE.EXE 6024 OSE.EXE 6024 OSE.EXE 6024 OSE.EXE 6024 OSE.EXE 6024 OSE.EXE 6024 OSE.EXE - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1900 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe Token: SeDebugPrivilege 3652 taskkill.exe Token: SeAssignPrimaryTokenPrivilege 3276 AgentService.exe Token: 33 2712 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2712 SearchIndexer.exe Token: SeBackupPrivilege 3096 ReFsDedupSvc.exe Token: SeRestorePrivilege 3096 ReFsDedupSvc.exe Token: SeBackupPrivilege 3096 ReFsDedupSvc.exe Token: SeRestorePrivilege 3096 ReFsDedupSvc.exe Token: SeBackupPrivilege 3096 ReFsDedupSvc.exe Token: SeRestorePrivilege 3096 ReFsDedupSvc.exe Token: SeBackupPrivilege 3096 ReFsDedupSvc.exe Token: SeRestorePrivilege 3096 ReFsDedupSvc.exe Token: SeBackupPrivilege 3096 ReFsDedupSvc.exe Token: SeRestorePrivilege 3096 ReFsDedupSvc.exe Token: 35 1900 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeDebugPrivilege 544 elevation_service.exe Token: SeDebugPrivilege 6024 OSE.EXE - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1900 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe - Suspicious use of SendNotifyMessage 55 IoCs
pid Process 1900 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4928 explorer.exe 4928 explorer.exe 1488 StartMenuExperienceHost.exe 2676 SearchHost.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1900 wrote to memory of 3652 1900 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 91 PID 1900 wrote to memory of 1832 1900 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 102 PID 1832 wrote to memory of 2008 1832 cmd.exe 104 PID 1832 wrote to memory of 4324 1832 cmd.exe 105 PID 1900 wrote to memory of 3216 1900 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 106 PID 1900 wrote to memory of 5912 1900 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 108 PID 1900 wrote to memory of 1988 1900 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 110 PID 1900 wrote to memory of 2940 1900 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 111 PID 2712 wrote to memory of 4244 2712 SearchIndexer.exe 112 PID 1900 wrote to memory of 4928 1900 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 113 PID 2712 wrote to memory of 2664 2712 SearchIndexer.exe 115 PID 2712 wrote to memory of 4560 2712 SearchIndexer.exe 121 PID 2712 wrote to memory of 4824 2712 SearchIndexer.exe 122 PID 2712 wrote to memory of 896 2712 SearchIndexer.exe 125 PID 2712 wrote to memory of 5060 2712 SearchIndexer.exe 126 PID 2712 wrote to memory of 3780 2712 SearchIndexer.exe 127 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3652
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:2008
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:4324
-
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:3216
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:5912
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:1988
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2940
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Downloads MZ/PE file
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:544
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4312
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6024
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4412
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5988
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3556
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1652
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3276
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4244
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2664
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1892 1880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4560
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1672 1688 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4824
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:896
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1892 1880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5060
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1672 1688 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:3780
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1488
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2676
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1120
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 0c418915808bd8465d39cec02189d93f5e412e487ab2c1a6ad00c3580be3956b
- MD5 d3b8674e592f3d5797e017b3cc5588e0
- SHA1 63a86e69b9f07741f08d92fff7bd354fe1686f35
- SHA512 fdac88ab1203f93479592a3a29af35b1a05b823ecc45cfc4e8365c18cc1dcef1db2d7162ae312ae270f9a9813f317cdd7060a1bae60808ff6467a85224eadc1f
- SSDEEP 49152:qb+632BuPkFKRrdE6ohQstBhuXjfS4LWxn0xrYpBZa8DkSyp:c3q6tjBIpBZa8wSyp
- TLSH T105D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 2.2MB
- SHA256 fbeee0d9ba0b58e78f098cd007c1dcf146f4fae41f307b2c43a65638f78fe281
- MD5 a3a3dbeee76fcd9386e38f5c63ddb511
- SHA1 6c085083d88fa010ae3c86a6d9be2b0dd02ee043
- SHA512 bc80d3b8d79778f58fe20f05d9b1693907164aa2ba470cefbd7b18e2cd97f26e31db3151a3141a3a61351b2338744a853b4c6bf4df3dbf3ca2381a935194eaf2
- SSDEEP 24576:2XYJ0lczA/osXhn6NmrVYLlBZ/y8DkSvuQCpvhvM3yReRdqmCAzxj884:QlcCxrYpBZa8DkSypsyMRYmJzxj8Z
- TLSH T134B51229B7D405F9FD67923DC9A28446E7327C5587A0FB8B03A4A53A0F336885D3E781
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 6bd8d02dc8f88710e7441d26901d6a021f50099cb4f28e349c1034bf809c49f8
- MD5 4db38af4da5c634a2b3c9a71ebf5e3de
- SHA1 adef7c96eb4c0d4b66d9d60b5d68648b0fc229d4
- SHA512 2dddd1c6c99f194bbbf35aaed717cde3b0fd44fb882255b119085bc4901cd0e6317405cf7265aff837f4ab2db80cadceda42cdf7bf1e56fb71fead60533a2827
- SSDEEP 24576:mXYfDtczA/osXhn6NmrVYLlBZ/y8DkSvuQCpv:FtcCxrYpBZa8DkSyp
- TLSH T168750228B79449F9ED67827DCCA29005E7337C558760E78B03A4A9760F336C85E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 1d5f22957f8aa623317c5b98e4f0627852da3a965026913f910e053fb2b02568
- MD5 f49c6ec4164ab5aba8e1f26b6f7a7976
- SHA1 836697b46cac031423c625efc2529b80a7803017
- SHA512 71b34dbde69c95ca5d19e9df48761b882c4a14df2186597f28abef7841fe1c5348eae3a87a6b4b1deb9ada1a20ae95cd2ae8aba8b49dd6d6a97b91df21a349e8
- SSDEEP 24576:u0Le5ji0hmxnrM2osXhn6NmrVYLlBZ/y8DkSvuQCpv:uPji0AxnxrYpBZa8DkSyp
- TLSH T1CB85AF16F6748335D073C0B9C5D2A68EE97130865B308ACB4286D77C7F67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 e7b7a7b6531f6dbd2dc595d25d7a9429dc6f0287d7783b91f84b9af26f5c6423
- MD5 e8c7eedb6a42e91b09f3c89b448831c3
- SHA1 385c6b7f58842a4e3dcf033414d92d1dba24bde3
- SHA512 50914fab4844ad5a1c32705cd75a2601b36a3efe5e94f7e2234b1bf3c09a875418b8ba47f61c7e73d8c6d6e5ef0b8389ef082b34177997d45f591ef66fff8200
- SSDEEP 24576:Ha7/ezSC6vUyDZaqgrvWx6q8wyuoosXhn6NmrVYLlBZ/y8DkSvuQCpv:K/ezSC6vURPvMHjyrxrYpBZa8DkSyp
- TLSH T17C755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089CB4246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 8dfa241ea379df4164de8b3639f5a2a3803dbfb721ebbff80053c5aa4f884588
- MD5 60af966adf71d95da694a028cf538e0b
- SHA1 1fffbb0bcd31dba1ad79fff49eafdd218a2e21c8
- SHA512 636b411bff7e009b05f344dbd7c19d0193736687d868adf211cb41f80906b452964e2d7c642222408affbeb6425ab5d413285594ba07d6d181a0486e941bcb80
- SSDEEP 24576:mVbqPb88hv/lV7zosXhn6NmrVYLlBZ/y8DkSvuQCpv:mVO88hXlVtxrYpBZa8DkSyp
- TLSH T1EA559E66F574C331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E67AD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 88f9194933da445abceb92e30e35bf19183d50edf24e6c16c457fd6df0566ee1
- MD5 1fc6a815f7d45c5c469c53ee8a208dd2
- SHA1 1ea1990f01e391d613309a17149cdf50eadef43d
- SHA512 8cd66a2f6e2731987f25a52cad9dc789f21b7dfc2e12c59439a635135ee8fb49283360a003cebcd04c8dcc16f6a240e7fb2187c12a6131fbbf003f8da88a6fc2
- SSDEEP 12288:mGj4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:mGKosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T15C55235ABB0CC2EAFF79E7B7C41A70C853086F00DB66991BD5203DAB42B5CCDE8155A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 1451e102b08b422f9d523c10cad4cb73a49378802f4ada4087e22814f7f04039
- MD5 3489c184060de32a05c3112b94d92e46
- SHA1 fd1ad1fe67836a42c50c3a598a228d1aaa5d7c3b
- SHA512 ee34f5590ecab99d4638722c987e00e5548c75e9aa79e0839fd09f1fccc52960829c2ee45ba0cf5343e13527afabd016ff763eb83ed2782146f03f16279cfeb2
- SSDEEP 24576:DJIULosXhn6NmrVYLlBZ/y8DkSvuQCpv:DJIUZxrYpBZa8DkSyp
- TLSH T14D75CF3BEE28FCE2C67E9DB95A518240D76278308F62A3CBD174820ECE235D55D79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 6ecb18a194778b7f9d8a3657874583abcb8f5a7083ac5c2320991c5d76184f35
- MD5 1453ed04f6c86ae0954ecc957a948030
- SHA1 97a60af21257a7a76b8d47cd209eb3aee0f51263
- SHA512 b469a2f9479039997a94c4ccc9025278abea205d18f6a041245d9534a4833d641194e10011cb13927fdb553865fbad81e162d1f6e05c4fb7c1b38d523e3035fb
- SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THN:+QvGAdlCEL8c/pRNw5CfpBZa8wSyp
- TLSH T125266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 c3a52789b7a592bd7049f6e67aba232c52dd364c5d977835bfbbc296d6749845
- MD5 3f726247ca53e5167f42a2b1bec8f265
- SHA1 ce9f886447c6aee0c617a3574ec871207630311a
- SHA512 302341ed506b1169b1345c54eb902758006e77fe63c2beda3973cc9f17bc90ea5276c993a1c49fbd1bef06c882f5628b695ff0c0c807f818ec630b7499a5d31a
- SSDEEP 24576:mwewsAj9osXhn6NmrVYLlBZ/y8DkSvuQCpv:/lj3xrYpBZa8DkSyp
- TLSH T1E175E031FE74E036D77F0DB61B26D716142CBE204B621AC3E3A85E9E49705C22776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 014c9918762335ce66baa62e0a9e649b8f126eb59b24bee0bbb46fb95b97a354
- MD5 73da857c7a450db90561d42f3af75af0
- SHA1 ad5eae953c888838238c2a94c75675076fb9ae6d
- SHA512 148650cd178bfc81bc294507b5054c56ef41b14320b914b7c31fb20e148883818da1f150c4023895c9944662ae142cc8aaca3b73f6d860340226df4c6779a192
- SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHyZMf:hUEtQevvqc2W1cpV29I32yZ
- TLSH T1A6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 5ab1ea3510ae686885bf280f5ad5fc729fb684afa5a2c0dd78a4ed6d6027474e
- MD5 8e8b456242d67617af3d23fdc2217882
- SHA1 b75bf59d7c82c0dd5430d3d0b15b339b75afa85c
- SHA512 1bda80088fa30c9d686fea696434b51d05a5163578b7602d66d6084e62a7ca010ce1807593141aa7d231bb6e7e7f18f68793e21346a567b4c6c8fc21fae6b36f
- SSDEEP 49152:7CbRquA/m2yL5zifFiV+XenmE3/zXxrYpBZa8DkSyp:koqHVjnmzpBZa8wSyp
- TLSH T154D58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 526aedb64b037b9bcba60c58b97943efa5328bdc996cc5253b4dfce3d22e36d9
- MD5 322d5591fb82c909799a3e3db1e4714a
- SHA1 0cb8af20fa3cd9c015cb1b8c6762932588470f5a
- SHA512 74bcc10b4d30d5ee2e56d1aa21a76760db9dffbb0585ceac379a9f68a81c1bb7adaa80a2cee9ac160d41fe9a73570631d92b386bdb2d7c2a4de3781dddafd62a
- SSDEEP 24576:vAhGLmIFoiwtA5l7S53UosXhn6NmrVYLlBZ/y8DkSvuQCpv:vAM1Foiq5WxrYpBZa8DkSyp
- TLSH T18A359D81EBF955D4F5B3AAB899B69170EA76BCA55E31C20F2160D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 93212a0cee37985a6edafa520021ffb47583c30d761ab40de9fc0f469f1c81b1
- MD5 3a23061f48c5b23d71050bde5119f8a1
- SHA1 98e3caae2140eba4edfbf23c283d8ab5de48612a
- SHA512 568f514a18defe9c86223f68fbd6a98b6b13f6974aeca6fea13c969f7b442651b36c62fe89f0aa57ed1e0b0838082181e07a80f90f20161190f66f001a06c627
- SSDEEP 24576:ywuXOW5osXhn6NmrVYLlBZ/y8DkSvuQCpv:ywQOqxrYpBZa8DkSyp
- TLSH T1BD65F14A77A80CF9E9679239C557D036F7B2BC012A21CB1F5760CA6B5F33251AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 f9fbf45b3848833f8f795079945e0c17dfbed9b4521cc88f2286bf78ea71b17e
- MD5 baeaf9c2b27acdf51c679e6dadb43423
- SHA1 1b2beb16b4967e87e04aec70f7cbf50accff4add
- SHA512 26aa6b10310d4e20742fba04b7eabee7d13d6354a842480f6a5272fc9ad030b5e3608850bde17712333f550b7fa85b9689fb77d630fda4204ce01d8da65624ff
- SSDEEP 12288:ibZ1Iye4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:CZuuosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T13455125A379861FAF667937EC8A56048D3317C12A73283CF552026AA0F73DC96D39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\WebView2Loader.dll
- Size 155KB
- SHA256 bb5fda5f2d3aae5e0977ab28d8a8a00acfd63d73748aaac32daf4fc6645b6677
- MD5 6d025364f66d8c2dcd882eaa3df83835
- SHA1 92ea55b6f46676c3b4a684fee5d7c1ed4e2e8772
- SHA512 d62f52c0aa0e54c6505e9a74e92424f378e40405ac4a383d9b6cf2cbee02b24187c72fb7436841a1ca249970e5ae60a703d1b85ad40a17aa66cd9a231ba04e17
- SSDEEP 3072:17+r33Gx3Xe/uy0A4BBnkDC49KMNU9eAT8uEtJjvv8WD73pe:1wnGV4p4BnkDCEKXEtJwmM
- TLSH T125F35C57B3E90077E17BC278C9634A45E772B8115B609AEF03A4467A1F237D0AE3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_dwm_svc.exe
- Size 1.3MB
- SHA256 0fcacc1972b4b783db80e4c9996a76a568f8c46771890303c740392740730220
- MD5 2d87c53633f0d3cd68d69f2b46a84039
- SHA1 c1bebc37419036c821fd8cb75d0fcb8f14350f38
- SHA512 a2036521b7b2ba46fae964c4ee7c895a52421b9398e587f7825a2feb0a5e8fa2612c1f2678cf2c977131d0db1a64259fc4cddebe08cd3c8383a6808fcc518781
- SSDEEP 12288:w2qzh4dl3gU4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:w2uXosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T1DC55122BB3D921E9F576977AC4661008A725BD305B329BEF4360166A4F336C89C39F31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host.dll
- Size 242KB
- SHA256 137ecc2eddf713556d2cee3ed74723f7aefc2e893cc0210c37587cd787af53a7
- MD5 561e88d9128ed8fc272f25c6c91fb69a
- SHA1 a1679ed8b099a7f3842740d546d45104ec115495
- SHA512 b4626303fb02ec2d86d2bc31b00e155f9f9ef73a7070b79a7a3a41881f25b9ff2d4786acb565b4aab7301a1b6935d4d9420150c6d5ecb6d2993eb6b1e351247a
- SSDEEP 3072:YqeAqGfYQej0qwPP1+YCflwUnMlKiD/FpargdG3km+Cm7S9kEXB9aosoQ75+7Rw:YiYhEgpFub3oKD5OR
- TLSH T1E634184477E50569FAB76B389AB35546D633BC526B30CBDF02A4420D9F27BC09839B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
- Size 107KB
- SHA256 f656731409df123bc9edf67b5667bae6d88275a086f463835a11fff436287826
- MD5 b3e78e973df9f3383e27726656896f18
- SHA1 415e7b02511072d82765e8c01bc9d602dfc8654a
- SHA512 21e220f5b564faf2faf6338f6a17b0a88e057782e90cb5b9dd78afd9067f9b3c28f567f817c69483685635215ee10d970d781079395da9f3e04690939d237fe0
- SSDEEP 3072:nM8lNaxkYbVKe9124fx6LvLVbZaZaZ8XWTwcsegYQIX:PaxfbMcTfx6rowgeX
- TLSH T1E8B3494BA3E900BBE172967884930A45D772BC0117629FEF03A4521E5F337D59E3AFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 101d2e34a1f32a9d520e59badf0f7ae83e62bc1087188504aafea48682511d8b
- MD5 46effefb027a51861d40d0c92982bcce
- SHA1 1ae5d85f03358b2eaa30c34487f13d8ba24ad1dc
- SHA512 749e7e1e60fda7ebf3ac6878a2a75168a5adc38644b0524b6d766b159eb760d6f7a1a0f10ecebf23884ac932c27f1ce354da5314552b7705efda74603fcb7e40
- SSDEEP 98304:WQRQyi36YOcPuLvw2gAf+PN3UpBZa8wSyp:dQyiKakX+PNgZMf
- TLSH T128667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 88542a0fc76570baa19e03a05f8d47bb241f979007991f793aacf0a900609fda
- MD5 5676855a7688c1eba01ed96a9ba3cef2
- SHA1 774668a7f815a2a61473ad111d51b600cc69164f
- SHA512 80751d6fb6df6d92b25fc108936f998ec78c66b60c951c266e3e30706f1eba16f96684251fa44f7d249ec4621fccd416582b3220f9835b9d6087a4c68510bfce
- SSDEEP 98304:TQRQyi36YOcPuLvw2gAf+PN3UpBZa8wSyp:CQyiKakX+PNgZMf
- TLSH T1B3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 d96a0fbeb0a80a61a00479ea3e6ade50d4cfbb7ee1c57d7c46ebd31e17d8a77f
- MD5 c65eac6ad2bd1bcdd46eb97f9a41fad5
- SHA1 c14d5c1c5f5f00f4779abef36e58ca9d7539511a
- SHA512 a348bdb65b8fda7b4dd2c03b12a50ccf4d23777f7d283543730552977c681a41ef5e3b0d7ea2d95e096395013dc3030093b47b4b568b41084f6d5d801f0608c9
- SSDEEP 49152:968Qg55nhxeWu7PNU3/nxrYpBZa8DkSyp:7thGRc/ipBZa8wSyp
- TLSH T116B55933B2F600A9C44DE1769F4A972196D17C71CFE1E3DB8511720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 54a3b5202cb2fdd8e9b49d6af1884fea3feab24c58592ff00aa5ac72312715b2
- MD5 dc0fd0e37433083ae146c76256e4d9c0
- SHA1 8800f9fe3346503205749a98345778949efc8973
- SHA512 027cf1b880c6d776c925066bb1f8fcc4ed2d19f2aa9fb18c079335c1434c412289f89abc20bc50e48caf0f9325353d983e5074fb1ad7989527f593d4d0bef628
- SSDEEP 98304:9y5112gYy5azzVvD69nLKnhZRpBZa8wSyp:gLIH+WhLZMf
- TLSH T1EB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 6200804df1c244cbddee5d0767c50685171cc5e15eab7b248fe72418b36fcde9
- MD5 cc85c468fb499a397a04da6cd722c1a1
- SHA1 4ca24088e3fa6adde41507df41267f5f5310c071
- SHA512 a2a89db16d69bdc9118aaba3ad0a249049126561ea11b3b803dea354a0f4c30f9ed92b92d192955cba076f294636161c59f81bc0d8970947af3de7dc0d5ab9a0
- SSDEEP 49152:QB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl1yMRYmJzxj8Z:Ku6JmTxd2dsYbJzl8
- TLSH T1F0E5AE13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 b71275bd10a185c409f08121de081e3112985354371e283f377c6107e16f13c1
- MD5 c7b6abcea24a7889976eb6c38c47ecc1
- SHA1 c845e4cb088e0fa1ccf28977d59522d66f7b7b4b
- SHA512 8c384198d750cef9a79fae4eb73a07a6c8d4f9bfa6386165b7dc149c552c404be3cc59522b514d24bd2cc9bf091f513fcf8502075b5ce85d42e61d7ffc515d6d
- SSDEEP 49152:L1hpsNoJpF1A6yU44CwH7R4x5xrYpBZa8DkSyp:LmifPVRzpBZa8wSyp
- TLSH T13CB5BE13F29901E8D06ED17887569232EA62BC460B34B6DF0A9077961F7BEE46F3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 bf56b9959ac6e2d1fdb8c70cda9f422eaf089e837ad8091fa0eb6510ba4ea54b
- MD5 a990278d788c836dc3f5fca370537fb2
- SHA1 fff2230dcf0629169407c62546d005c6409e3cdb
- SHA512 238157a077ee5ed52b2b31573c807cb38c7a100a1a33d9702ccce80899b37c3707ce5a78f29c0690405fda3bb53e353429ab0738a9ae652459fa6571cc69e2b5
- SSDEEP 49152:SSuZQIY0Be2KIRVtOnks6NMHqExrYpBZa8DkSyp:M5dKOi61tpBZa8wSyp
- TLSH T1F8C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 7fbca1e20ea61d15c5381e74f344df41ffc63b18321d3db19003f67181a6c6ee
- MD5 c4048e53c972a74532c11e8a186b1a3e
- SHA1 e595ecd122c79deb71011eba082b5c3615b4cd47
- SHA512 0567169ab0b923220e5ad1019655323a00dcf34c90aed48dcabe3552b4b93069050bc6130ecc621552eb4d5b6ee42ff8a6b1848071c3df4719444279247ae4b3
- SSDEEP 49152:ghtSn8EApI0figGgiDn0AP5wlxrYpBZa8DkSyp:xX2i/ph3pBZa8wSyp
- TLSH T16195BE13F2D900E8D06ED179C7468632EA62BC150B35AAEF0A50B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 01b6821b474215d0137d0fa87e16d94c7ad01862d3e1347c1ab83c14146d2237
- MD5 50e42a3f7c03432a5c546039201efd60
- SHA1 c428e1a5c287aa086cfae056f1c7f4a0dd3e9704
- SHA512 192841a62dbc912794d7ea7cc2cde09b39c9c97ee007faca182da5c2ecfafe2fccd91b2b1552acb5fa1699132b2bad288064aa84eede71e82433d1440046038e
- SSDEEP 12288:kL4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:kiosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T172552319BA1DC2EAFA29E7B7C41A70C8530C7F05FB27951BE624396B43B2CCD68154E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 0c5d32cdbc52e7009ae5d8dc4a92f8b332d9540ef06eb5cd2e56a6eb89d6d26f
- MD5 4add4b9a6c267d6a99446926737c3c62
- SHA1 31f61506decc6c0e80a871ff692362ec6dbd5ceb
- SHA512 82ee5b9e58881efc250d1031858edc5e746c54056500e71e1750c48b65073d94664c9c432fa5409aa2f6f4293129adb71a981598b0e961687aae12ef1bc4ed3e
- SSDEEP 12288:T64TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:TBosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T11A552319BA1DC2EAFA29E7B7C40A70CC53087F15FB23951BE524396B43B2CCD68155E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 abd567571382da15e975e7fc4f4cd1f0c77cd16c921409e326c381c12604b1d4
- MD5 c3f54bd5743a37df6cc940450b31292c
- SHA1 1adbb76a96c2d3fb8797592b96fffd57db2d6b12
- SHA512 df9e6b7071c1f0adb211b00297c19267ae75a6c3c32c818e3293297499b19c7e8361f3f5ff43fb19e141636e476fc38386c30bfe1444f90639a75ee56df021c5
- SSDEEP 12288:Y44TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:YjosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T18E552319BA1DC2DAFA29E7B7C40A70CC53087F05FB67951BE524396B83B2CCDA8154E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 a3da71f7d647393af3a2c2d0327f855b47865a58134c387b7ae23438b91fe89c
- MD5 741bdcd51ba08aad3a49d027b7002661
- SHA1 c0b0960401ce63ba2d91f328de6c678d463ce968
- SHA512 3fd589fb98e1500ef25bf58985e23a9c41c5d96e95c8c22194cf42a7bf39fa5112c6b7e4c06a634329efcd2cb38eb3f2cdc866bc17bbe70bd8709b3ab47ab2c0
- SSDEEP 12288:UVB4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:XosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T1405523197B1D82D6FD75D3B7C4167088A3287E15E733965FD6103D6B0BB29CCAC24AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 3a7025ff3d72dbb9e0d61abd46df20f1877d3bb3363fbfa7c4308e53cdf73654
- MD5 af8e1fed6cf2973ac07b3fd8d9df4778
- SHA1 5914cd256ed513402d21193ffca1fb4d9f127df7
- SHA512 5526fda6d9d6bf3f82adb2819ad14e6a7329dd9b80d5bf92fb021a9f8bbc4eefe5791cd5c8cf082af3aee5b2e6a1548f502a7cb1369513a3facafd3fae662cd2
- SSDEEP 12288:D54TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:DcosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T195552319BA1DC2EAFA29E7B7C40A70CC53087F05FB67951BE524396B43B2CCDA8154E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 88de2a59ffc7aac78ee79a288b04216277666d23ec5a66ac13b37abccedfc656
- MD5 e8575a62c96b33e39810fc55a80de1d5
- SHA1 fbcc257ceb0a89b9fdff0d8d476dee7aa4bd3ef2
- SHA512 9f2403cef559c165ce578c12991ec8bc67b466e1617b167a124adc7aab8683b413842b9361ac36097f162cdeb424b06d2ff5a8f7bc3cc0057089780da43410a3
- SSDEEP 12288:o24TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:oVosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T129552319BA1DC2EAFA29E7B7C40A70CC53087F15FB27951BE524396B43B2CCD68154E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 9f9da05794532509d5aa4b44a55ad8ba2865518bd6ae15f71c95af431b48b44e
- MD5 fb09e01f8d6314cb3dbd8ff3105d9b03
- SHA1 ad2c892066d9bad3ac92ecc789a1f385b522c393
- SHA512 6b1e24e7e3bf63bd62a2fa88d0063b8e1c460f8ba7750fd8a7371edfa1a02b3e14726fdbda52b898753472fbd64bfbd37335d7c85ca6b5c0fff363f12af33dae
- SSDEEP 24576:LXwvtk9RX6wkyAIovM3yReRdqmCAzxj884:wMnYITyMRYmJzxj8Z
- TLSH T1BD45E029EBDC04E5E1B7923C89B3464AF6B178691B71C6CF125A536E0E33ED06D3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 3452077fd5e07724c0d9a6c25159a52c37c2f7443b6f71a4c7f3272343779906
- MD5 fdf546ab1cedf04290052a9a95a3a8f1
- SHA1 e54636d14bbc9b2ed9598ddb29fac526f79fac64
- SHA512 bf3d213e7711772caddd7e9ec8bb6b94cf3a24c66e28a7d3ed625eb9b847c7ea9411f105d019be62f801de6948707cafa00d7d3abcf727aedeed74a32e8291de
- SSDEEP 49152:vYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FxrYpBZa8DkSu:hySzP0pBZa8wSyp
- TLSH T1C3066C96A16841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 850738540a342432e471a2de6b27e4887251e400a64713498112cf731afee2e3
- MD5 b1ba2c33c327082d56634c3534963d18
- SHA1 4a15bcff4dbaa1563b3d8c2b6ce7c0b9d02fd4fb
- SHA512 2e8da2a9992b3297bb5d92c05bc47d9ba978ff00c80faf0a8a12a30e8a364d02b6ee9bb9da59fe724e453dd20c265a15719e1d288c245d741af0d380992caf87
- SSDEEP 24576:247Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYxosXhn6NmrVYLlBZ/y8DkSvuQCpv:247JUQjairIhCnDHUPfF/VxrYpBZa8D+
- TLSH T12C65AE1EA3EC01E5E1BA927885154A5AEA71782D1F32CACF1270437D6F23ED45F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 0b6aa66bfaeaaa2639d070c9a51fff31e1003c8bb325a7e548b3490cb9cb781b
- MD5 fc0599dc1c8339f21506b8067febf9bd
- SHA1 7b04ca4d8e5f0702c33d43d756775902bbefe044
- SHA512 fe476348ccabd34a3b117954b90073b605e076fd64e83a40fcfec739804a5fb95c4708357460e42b26a79f1259da171d5c76dcf916e8b5e3eeda68510eddf6fe
- SSDEEP 12288:Iksfv4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:yuosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T187650119E25842E8D06EA27AC7065140B3373D2597E2D3CB92D0F93E0F769C4ADE9B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartDocked.pdb
- Size 19.2MB
- SHA256 f3ae7a839a71d71777e73dcef2c746e50de817f7fc55b693f442921db8f50672
- MD5 ac6b6d7ad98c42d848df73cc0e7c5006
- SHA1 53f82a5fea00734f9d32b3871a4a8fcca9da8d3e
- SHA512 2093c8f4f4e67422a2e81968678084fab699f90de0f49f33c93bf47eb968c1fa4d1a3716f2d6901210ade62a71c1b3f4dac8c0df328406df75e392a0f60dc76f
- SSDEEP 49152:6mdWc7jxfK1k009VS2UZB4ErL0PK2kyvlWPfGkq6kvxh2yX3N3F3O3N3n3LeO6Q3:OSkPsOG6
- TLSH T1CE17B42071F665F7F2BE073741C6434C1A7051D357A289EB992433542EBB281DBAB2BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartUI.pdb
- Size 34.0MB
- SHA256 7bf15ec5f19f0b2d35149ddf642ea08e528b178e2c7145982e5a8a8a1f5ddddf
- MD5 e102eddea71961b0d4af9bec446ece07
- SHA1 fd4cfbe1216a70d4610367f292fa11aa350c8040
- SHA512 d17274c4beadc23bf67e1878a30194d99c3e4ca707f51e6072d3f7e7432da12d96d7ede4d23be08576b8ac764610aff27683ed4046e1b2bf41de84066ef149b9
- SSDEEP 196608:vPcF1Vbv8dJ6EPigdurTKKR68aMfUDCaN4QlkqYGxR2rlP9rKoyEXv/uIqvLzfHg:00joJ
- TLSH T17177D619716762B7E1BB0B7B4DC64309137151A357E38DAB192132342CBB341AB8F6BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\explorer.pdb
- Size 2.9MB
- SHA256 d1a3b2eae2fe59758dae319da8d274b25a288ebca63b26ccb4fd8d1f2a27d114
- MD5 7ae13d4f0144d0c91aed5f37a7d49b64
- SHA1 4fc85c1e0ad8ed30efb9e52fc39c77036c2e1d47
- SHA512 5d5ba4118df535020947fc5cb247d237663d236bdb2ce86b3d58502784b017576ebc16a594ab6959a22aa595a3df6361a965d53540382ba42452b4c391b5de1e
- SSDEEP 49152:GISzUWGT1gV544+MfutyEoZ5eNmklItrv:GIEThR3Z
- TLSH T162E5295273E750A1CA3F17B2A0178389EBB69953239187EB3C2673A21CC3142EF5F655
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
- Size 27.4MB
- SHA256 7a74f35cd9d0069325463b918e9cd6272bf1563608202d99a21742dedabb1d45
- MD5 476cfdaa7da7a868cac3fcb1a3bcc718
- SHA1 740b3434f0ae9f581787fa4fe23513b9bcd065cd
- SHA512 f74b02f59a67d21a4cd1567b33e9d53f7dabf50554865f594c04e8e40399b22bfc274739e22bb7213270c21729474e0d8761cc71beb1257476af1b59b74cc473
- SSDEEP 49152:sGDBmCileB++IGHaJ84trubfLVY5UL86TJUXysPGVzlGWcuJdSmV5odM/YJWVliW:ACiy+dG5GigUgjSMVgF
- TLSH T13A570A6373BF10A1D9BF6337818757996BB6425356C2C66B253633229CC72878B8B34C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 480c1edce2ba0eee3592e3bd1acae2621da0df9eb1e69552dc582790fabccd81
- MD5 4c124d33f2a73a1b9e1762e849325e7d
- SHA1 c3a2fa8c65adb6d19d8528c111eea49bf27b88d4
- SHA512 c542b32803e8dd0cd19d9fd4e518f00a18f6e62e2f557d737e652c93531d49bbe681dfc233b3c525213b9d1dd1bfa1b24b3eeb211847c820918c7c0e64f2d4f4
- SSDEEP 12288:Xz7n4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:XWosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T1F7552329BB1DC69AF939E7B6C41EB058630C7F14DF22849BF51039AB42B1CCCAC355A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 16f9b77cf1b28c221c29f66e74441931db1ed80e6a981a88a45a63a7bfdb5972
- MD5 eb7f6c0f772a3e1e2cc935dd2b62fca3
- SHA1 32ff3faae4d175c3729db15dcafb729c1aaab2b8
- SHA512 963192857df669f67e3a6d0bc34e18c2ed3b062a2017f5ae8e6ab0579a6000d37374fa6353afad6bfe1f00d822b9edd8037e2d3d5f493a2945575636ebdf848d
- SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYoosXhn6NmrVYLlBZ/y8DkSvuQCpv:Ugb4mBIBhGFjxrYpBZa8DkSyp
- TLSH T18C65AE1E22EC02F5E0F9D2B8CDAA4417D6B278164732D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 832KB
- SHA256 04480487d09b4866fc3a19041fc1752b65747de342a0e063da5efa857c4b8c62
- MD5 eb12591e713bd34d6b3e8bea333ab2f8
- SHA1 20c6e50bc917a0b0bafb6db1e8e9dfbbf20bbbda
- SHA512 95494a7ca54e5b9e8f21c04d85ae16f04e7790b0096692dd702808d26bb1440d22fc9f0c6f4118d7bf9fa9d9d6150ab85062f24afd9435bffca92ffbfdaaac31
- SSDEEP 12288:BJGPyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:3GYvM3yReRdqmCAzxj884
- TLSH T14005233EE2F13068E6709A3552614AD7F9B1742A5BA4FEDF9090A03D9F333E06935C49
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 bb8967cb0603377fd9374dc6b8495bf8bb23055bd2d19c323866b1ff0dcfc219
- MD5 b8c180542fc6c3dc7af0581d7817d2a1
- SHA1 1b4e716802b130d812e6d8f8d31b0797d1dd7d61
- SHA512 348684d2244b125f396eea893d9acb7f328704474073e507c7714c70c8affd9f67bc9625f443182794f9e81af1ccc120ce934f79d2f4dd408a5602f8e693fbd7
- SSDEEP 24576:mG88u8FpJqH1nzria7/mhosXhn6NmrVYLlBZ/y8DkSvuQCpv:t7ZFPqV6a7/6xrYpBZa8DkSyp
- TLSH T1DA85F165B7E502F1E47BD138C94646A3F671B8250320EBDF06A88B561F33AD54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 7f5527822e118d0fda32d845269b8bdf6358ee19a809d12275ff551e8e70f965
- MD5 c466fa37075f4206ef8158948534878f
- SHA1 a48649988a8b39724dbb7142c91a005a23bf4fd8
- SHA512 71a288363020a7c64eda5df2915352268a74e3ff68737001e3eb305117c194cb1ef15080d83edb9a0878387d83eb5d61d9e76dd1cf48bfb5734dd903bd873392
- SSDEEP 24576:pPUr+NQlosXhn6NmrVYLlBZ/y8DkSvuQCpv:pJQfxrYpBZa8DkSyp
- TLSH T1E165E12F66AC18E5F67AE17DC9469209E731B8625712D2CF02A0517E4B73DD8BC3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 8107b5451dcd0994f378eff3b0d0bcc9f96eec66cb074f4dd741dbb03d34a9c7
- MD5 39f55c0af0df3b75c15cbca84bff7d57
- SHA1 61c962fee02f7ec3776f044c500c733265e22899
- SHA512 9bb9f14582014a8e820674456dc356854ed4abcb5c2aea32a84725c79a4fdb9dda0845a8341a734ac858726035a8aeddd87906b029d69c6056c2c2dd3a28cc76
- SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPxrYpBZa8DkSyp:PG05lO43bJpBZa8wSyp
- TLSH T1AFD5CF6E62EC11F9D1BBD17CC986460BEBB23815033556CF02A486A91F27FF4A97E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 934cd45b81f91f7e7e7abb73ef3ef8c37a5cdfee276778c7c12316dc3c554f45
- MD5 9a908bc117c6a736ca28680c3bb7e7d8
- SHA1 6feb5e7380aae4e809e27fde2edb685b751f34d5
- SHA512 062b586367b83159ce246c32040009b1e78a9cd8a1dd34689d69449300af784253bbd95a694f83a80013347d58cc1a1e50ce58fda5bb156f13969a2983673eb5
- SSDEEP 24576:ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidnfosXhn6NmrVYLlBZ/y8DkSvuQCpv:na5POZ3hJt2pasx2+mnxrYpBZa8DkSyp
- TLSH T1EA65AF5EA6FC01D5E579D17DC583861AE5B1342153329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 accd6f44ad1a5526db00455a57482f94a8fa106be8bb2e453de77873499913df
- MD5 bb6632f26d42d672db6a22f2960b8212
- SHA1 8300cfcdabd65b9786988ea0dcabb03996b854df
- SHA512 e3e503762bb9cf9796b286e8a06f0e8536666d5dc36bc4c666760ac30d4a1f18c4d47ce81514aad8e2b0540a480bdd1cf02071ff695dd180f05af89982f4c723
- SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkZosXhn6NmrVYLlBZ/y8DkSvuQCpv:uNc/zEOVHFaxrYpBZa8DkSyp
- TLSH T140858B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851F1E73BE45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 948KB
- SHA256 49c12d08a185eedd808710d2e7555e721843b6c7b64ac77fb5d2f289641a8860
- MD5 f7ffeb9629254f08f7d78e7d03052b5d
- SHA1 523c520e96a78e44fc2de6e80715ffed410a27f7
- SHA512 4e8aee30c67b1684254fed044fa87c162d89f02b2489adb755aafa4442dfb3599dfee5b3c30251c54b73d9200f7c2f44d8deb413156064ba01400b9c3fe23016
- SSDEEP 12288:AiHPkij5ZI7RyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:miDIOvM3yReRdqmCAzxj884
- TLSH T1FF25126D63BA10B9E177D03E82830543D6B2B0758762AACF4694D07D5EB3FD8BD38A41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 932KB
- SHA256 c3af121a5974bc876f16fec190641b6992b97b5203cb114148d31e6098f49b0f
- MD5 6686e5ee410fc75d7622b323ce44e5c8
- SHA1 34a589344eee5b9a37a92d01b2845c0620e98ef8
- SHA512 266e8ff2dd4b671b5700d73c60c007bcdc1ca964bbc5067c876a777fd462ffeaebfba3bb09d5b89e0da47f0efa69eb240d1faf920c2459031c7175840410ca9a
- SSDEEP 12288:KG6kyUyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:DtyxvM3yReRdqmCAzxj884
- TLSH T198152215A3D46098F6B51538976282D6CE35BC255FA1EBCFA190F23E2E337D0AC7170A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 804KB
- SHA256 5866b029516d4729ce10662d36ccc7903c48a729a5f907b4cc5f2a3016b05c30
- MD5 4ee36b9226ce576a3b8bd6d589d78915
- SHA1 c5206ee804c22e4e0798c54f3ec4e9f40c56b88d
- SHA512 a4a5c6c09c05703fc3f7009e1e15132562c858f4abd4171b9cbd1e9dcb9cbd29126bee135ff5bd41a86c22aa09b1d84d6eed355c785ae53f5bb8ae34a38d2622
- SSDEEP 12288:QfjyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:kMvM3yReRdqmCAzxj884
- TLSH T18F05237AE3A42118EA60693513454BC7D966B43E6FE6FECFB090B03D9A333E11C7104A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 d019c6a6cc6e37558430c372ccbfc50dff4a0a99798a96605dc812b3877adbdd
- MD5 f8c7bf6ade300933540117c482e87614
- SHA1 4f70c60b3fde5f31b9415829f46eebf6d1bbfa3d
- SHA512 eb1ee6604cfcee7c2cb204172a5aaff2b1ce69550fa42a3db9a6548909c049144cb512f3ca01de466d3782fd6dbe9f05d8fcae147f1bf3400650ea452be3efda
- SSDEEP 24576:37gEsoTfaidZQovM3yReRdqmCAzxj884:rgWTrZ2yMRYmJzxj8Z
- TLSH T19665AD1DA3EA05CAE2B2D639D9721493D633B4315772D6CF2448C03A4DABED8AE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\dxgi.dll
- Size 590KB
- SHA256 70a7d2ce085dc0db96d00abf351e5e316572801f5d43648e2ad47fd66ba174cc
- MD5 ced49a7f0a466a1652bd01172df2b5a8
- SHA1 4eb49d34e593de5d05c44df3f762359752011fb7
- SHA512 6ccffcd77bebc01e5ae15d00a94a5d489c231e7f6232c971127b01f1d5871d769e11ddd951ad04b9d21a7fa9bc418e4ae29363b00d8b77d8a6f6cbeaa18073ab
- SSDEEP 12288:GyP1gTP0RRejAShO/ddkHa2CFEgxtUSgRQHmB:H9uPmRdv/ddkHa2CFRqiH
- TLSH T12DD47D12A7F900B9F5BBC674CA634522EA727C461720DADF0390895D5F337A1973EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AgentService.exe
- Size 2.1MB
- SHA256 6dbaff5c3754fc698f22a6656d0aa66eb322c134e9c74a7039d59113e8dd9938
- MD5 e6a27ced4d0955a4a91489b362d2ee7f
- SHA1 c724d51e0d46bd05f72dbeb495c461e2f21110ca
- SHA512 05ebf074a0ef84e1c44f51c6445872a8487d3a14879f1c88fc027bac2a3146cf2ecf9f482762d32871797eae464b87764179b00b32a41c15e57ae9388edd9847
- SSDEEP 49152:8gb4mBIBhGFjxrYpBZa8DkSyp/yMRYmJzxj8Z:8t3pBZa8wSypaYbJzl8
- TLSH T1EBA5D01E22EC02F5E1F5E2B8CDAA4417D6B278165732D6CF1150422D2F37EE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.5MB
- SHA256 8166aa1f998304b06ac39dd0d8aac06839a073b8cec21b0a9907cd2f8b4054ca
- MD5 589197e7900574f0c526b0e9174e7b39
- SHA1 82b6400c6c25b9c5f591b786479e4d8dd20949a8
- SHA512 82f97ee6a37b0769429a80ca08bc32a7527225fb36906a075934b5e7b2ea5d88a3c147859f11a83dbbf65befb2abe00778a14de53b11b94b7af1c6d40799da8b
- SSDEEP 24576:wTkNvNnaFeYhJNtmZBmdvM3yReRdqmCAzxj884:wTMwBtOmIyMRYmJzxj8Z
- TLSH T1E775B06EBAF806E4D1FAC6758E238512EA727461073293CF5290C13F1E279D89D76F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 2.4MB
- SHA256 c6054406fc7e3511aebd0b4bbccf4c728a976f1227865a36e8c9340177d5feb0
- MD5 12e07e8c5539ab947fb8c8a27bb2153f
- SHA1 b53561fba9895715005a51e819d1502ddd159b06
- SHA512 37439c586a6d043b85e3d10caf2a90cc7c44f7a10fd7c2f698ce935df621dfd65e309576a764f529a2ce0914e3288981e06c1c0b96b36d4a65c73a18f589c68f
- SSDEEP 49152:/DVHeBIAAQxrYpBZa8DkSypRyMRYmJzxj8Z:zpBZa8wSypYYbJzl8
- TLSH T1B8B5023EEB5C00E4E57AD27CC6538506E77138AD0722AACB129091BA5F77EE47D39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\TieringEngineService.exe
- Size 1.1MB
- SHA256 85a6483290a1550f5a1e070c4838b991209bb6f188d62218676b7876bcddfc9f
- MD5 131a8c38230fbaa9a068cf0dd28e4291
- SHA1 3a45c49035bd51e70b8ee7bece021b9bfbea70e2
- SHA512 17bc0779c185d7634350d5cd5b5c8d97444bd2d991213114e7b340f199ad33b4f44c2fb229e75d2c9f114859d121e68b6a0acc432e2d18677abe6673847412a7
- SSDEEP 12288:xMHPJnJP6szeCs6Rl28dcyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj2:sJnJPbzB4S5vM3yReRdqmCAzxj884
- TLSH T16F35E03DD2A810E8E4B7C274815A1B9AFE31386D2F2669C755B4D0353F12FE0A979F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\locator.exe
- Size 796KB
- SHA256 4160abaee8e02d57b13a57dd0b25828505f4a2fb75026de2b7738219ba175460
- MD5 0dab2e3de489e29b7aa463d018fea88e
- SHA1 1d2b456d763289f4b0810e72fa5d2b06542e11bb
- SHA512 2e595d11c263e11efb075b002b196a70cc0fa022214f7930dfabd70e67bf824d85cd2d22782fded58b4f302aa8aa9d4ea64418d3c74cb010cdfcb3cc92065ccf
- SSDEEP 12288:Vg9yLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:VgevM3yReRdqmCAzxj884
- TLSH T108052376D6A45119F7B06D3123414ADBDA56B82F6BE6FFCBB014301DA4333E26CB108A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 940KB
- SHA256 e42575b9976a92f195c2228f5d3ec139463360e4564b8a4fd3c2f45055d89bc7
- MD5 08ddb0fa1777e71947afa84cc6c0202a
- SHA1 031085e3825877873db8c59bb8de987fbcd2e320
- SHA512 e9ee10d3ed864d3f7350772871f00a7bb3b7b12ff4deec1f9830a6e11c924991694bac1091302159d41601b92a806d66732fee8f13627ad106bc04673b64994d
- SSDEEP 12288:5yL6b3IkxjbBz8yLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:C6UqjpZvM3yReRdqmCAzxj884
- TLSH T11A25226E97D020A9F1745530966182A7C571BC371BF6EADF71D8A13E8B33BD0983BA01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\vssvc.exe
- Size 2.2MB
- SHA256 5a188f54d4dc38471e570d60234e4e8c51db36fb9257545a432e08e642d865f0
- MD5 204b44d487d89eefcc807241055370d7
- SHA1 03e689bb252780bb5fd5945ff182e13b3fc401ab
- SHA512 d78a6bf389618804dd78d9ffdf21797067ed372f0cd639893dd3f17e13bcea0b6044bace96fc5c73c26c278bf48c70a14e2ab1240c0371f15f506c1e39bb3e02
- SSDEEP 24576:kCLHGL0MoeVtFumTijCmlKQWDkRvM3yReRdqmCAzxj884:kCLHGeeV5ijCmlDWDk0yMRYmJzxj8Z
- TLSH T184A57C05E7EB5184F8F3CAF5CA2294169A327C549B34F7DF4A80C96A2E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\wbengine.exe
- Size 2.2MB
- SHA256 4cbb6419b538f268b87ecefca846ea17fe39a2aa58d5b1afdde055517e1d14c7
- MD5 b49ac88cb420733cd1765694b5943ee3
- SHA1 4ef0c72ae18ef6444b253b2b2dee54afc71d7cbc
- SHA512 06555f1511524ddae61196a4f6dfc865948547e57d36c22bd10ead7b57c42b14165e88fe4f10f6de22bd4870ce5fed89b366b48f12398967205b996330459b23
- SSDEEP 49152:ZDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3XyMRYmJzxj8Z:K3Upow8sBnYbJzl8
- TLSH T1FEB59D3DA2E800A8D9AAC379C54213A6EA71742E3F3055DB0174C178BF1BEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH