Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 17:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
- Size 25.1MB
- Sample261030-wcb3jsdy41
- SHA256 2fe11bf1c394cb5784874dc100602fe92fd8a93da6a34b80274c081f5db83106
- MD5 c30a8624812a9256723c07ec7e678531
- SHA1 47ec08e60cbfbae11c9273a0a1d9169c0164abf1
- SHA512 f9f0e261c4b3dd3f538b05521a16d48fdec6cf5ca1837dcd26bcfb5200270abbb08bc83cd87fb6ca2866e452cbb7a9c74f7b0ce4059848b2ee1f2fd4ed1e9529
- SSDEEP 786432:i50UITURsFpFH++FWlxm2YYJppYy5qRqgyKAGWzcnZYYz:y0UoURsp/F12YYJbJ51l5C
- TLSH T107473329AFD2068AF577827994B3466729EA3F036734D86FD250054C4D33BE6C938772
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c583-36.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 18 3192 explorer.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 9 IoCs
pid Process 4400 regsvr32.exe 4400 regsvr32.exe 2196 regsvr32.exe 3192 explorer.exe 3192 explorer.exe 4308 StartMenuExperienceHost.exe 4308 StartMenuExperienceHost.exe 3428 SearchHost.exe 3192 explorer.exe - Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in Program Files directory 31 IoCs
description ioc Process File created C:\Program Files\ExplorerPatcher\pnidui.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote150x150.png 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\connectedsearch-appcmd.searchconnector-ms 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\connectedsearch-music.searchconnector-ms 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\connectedsearch-suggestions.searchconnector-ms 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\connectedsearch-zeroinput.searchconnector-ms 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_setup.exe 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\pris\Windows.UI.ShellCommon.en-US.pri 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\connectedsearch-paths.searchconnector-ms 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\connectedsearch-protocol.searchconnector-ms 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_search_charm.pri 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_weather_host.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\WebView2Loader.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\en-US\pnidui.dll.mui 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub150x150.png 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_gui.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub71x71.png 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\BitMDL2.ttf 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\connectedsearch-history.searchconnector-ms 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_starttiledata.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\connectedsearch-contacts.searchconnector-ms 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\connectedsearch-results.searchconnector-ms 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_search_charm.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_dwm_svc.exe 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\ep_taskbar.ge.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\Windows.UI.ShellCommon.pri 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\SkypeUISymbol-Regular.ttf 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote71x71.png 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe - Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib_orig.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\dxgi.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\dxgi.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4648 sc.exe 5352 sc.exe 4524 sc.exe 788 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4164 cmd.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe - Kills process with taskkill 1 IoCs
pid Process 2384 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{3056206A-46B4-4D06-808A-86FC3B3EF4F5} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PromotedIconCache = "{7820NR73-23R3-4229-82P1-R41PO67Q5O9P}" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\UserStartTime = "134378559928797655" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\ = "ExplorerPatcher Weather Host" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\AppID = "{A6EA9C2D-4982-4827-9204-0AC532959F6D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{C25988B2-A225-45FF-9692-92B6401C886D} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ = "PSFactoryBuffer" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PastIconsStream = 1400000005000000010001000100000014000000494c200601000400040010001000ffffffff2100ffffffffffffffff424d3600000000000000360000002800000010000000400000000100200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010320141067af2a24daff2a24daff2a24daff141067af010103200000000000000000000000000000000000000000000000000000000000000000010103202520beef3732dcff2a24daff2a24daff2a24daff3732dcff2520beef010103200000000000000000000000000000000000000060000000ff00000000141067af3732dcfffefefeff7a76e8ff2a24daff7a76e8fffefefeff3732dcff141067af00000000000000000000000000000060000000ff000000ff000000002a24daff2a24daff7a76e8fffefefeff7a76e8fffefefeff7a76e8ff2a24daff2a24daff000000000000000000000060000000ff00000060000000ff000000002a24daff2a24daff2a24daff7a76e8fffefefeff7a76e8ff2a24daff2a24daff2a24daff000000ff000000ff000000ff0000006000000000000000ff000000002a24daff2a24daff7a76e8fffefefeff7a76e8fffefefeff7a76e8ff2a24daff2a24daff000000ff00000000000000000000000000000000000000ff00000000141067af3732dcfffefefeff7a76e8ff2a24daff7a76e8fffefefeff3732dcff141067af000000ff00000000000000000000000000000000000000ff00000000010103202520beef3732dcff2a24daff2a24daff2a24daff3732dcff2520beef01010320000000ff00000000000000000000000000000000000000ff000000000000000001010320141067af2a24daff2a24daff2a24daff141067af0101032000000000000000ff00000000000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff0000006000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000fe000000f2000000e2000000c20000000a0000007a0000007a0000007b0100007bff00000bff0000c3ff0000e3ff0000f3ff0000ffff0000ffff0000010000000800000003000000040000002c000000010000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\IconStreams = 14000000070000000100010003000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e4c000000000000002000000ea070a004100720067006a00620065007800200033000a005600610067007200650061007200670020006e0070007000720066006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000cbb7a5a39668dd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000ea070a004100620020004e00680071007600620020004200680067006300680067002000510072006900760070007200200076006600200076006100660067006e0079007900720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000200000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000d6de57a49668dd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000007b0031004e005000310034005200370037002d0030003200520037002d0034005200350051002d004f003700340034002d00320052004f0031004e00520035003100390038004f0037007d005c0046007200700068006500760067006c00550072006e0079006700750046006c006600670065006e006c002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000ea070a004a0076006100710062006a006600200046007200700068006500760067006c0020002d0020004e0070006700760062006100660020006100720072007100720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000dce282ba05f4ad47b032cf0faa0e3933000000000000000000000000f3e777a39668dd0100000000000000000000000000000d20218f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\NumMethods\ = "28" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32\ = "C:\\Program Files\\ExplorerPatcher\\ep_weather_host_stub.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ProxyStubClsid32\ = "{CDBF3734-F847-4F1B-B953-A605434DC1E7}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\IconStreams = 14000000070000000100010003000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e4c000000000000002000000ea070a004100720067006a00620065007800200033000a005600610067007200650061007200670020006e0070007000720066006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000cbb7a5a39668dd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000ea070a004100620020004e00680071007600620020004200680067006300680067002000510072006900760070007200200076006600200076006100660067006e0079007900720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000d6de57a49668dd0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000007b0031004e005000310034005200370037002d0030003200520037002d0034005200350051002d004f003700340034002d00320052004f0031004e00520035003100390038004f0037007d005c0046007200700068006500760067006c00550072006e0079006700750046006c006600670065006e006c002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000ea070a004a0076006100710062006a006600200046007200700068006500760067006c0020002d0020004e0070006700760062006100660020006100720072007100720071002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000dce282ba05f4ad47b032cf0faa0e3933000000000000000000000000f3e777a39668dd0100000000000000000000000000000d20218f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PastIconsStream = 1400000005000000010001000200000014000000494c200602000c00040010001000ffffffff2100ffffffffffffffff424d3600000000000000360000002800000010000000c0000000010020000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000000000000000000000000000000000000c0700100c07001005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000000000000000000000000000251501309e5802cf000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000000000000000000026150130bb6903ef945203bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000000000000026160030bc6b03efc97103ff965402bf000000002923d7ff2923d7ff2923d7ffaeaceffffefefeffaeacefff2923d7ff2923d7ff2923d7ff000000000d070010b26502dfcc7302ffcb7202ff975502bf000000002923d7ff2923d7ff7975e6fffefefeffaeaceffffefefeff7975e6ff2923d7ff2923d7ff000000005b330070cf7501ffce7402ffcd7302ffbe6c02ef000000001b1794af3631d9fff1f0fcff7975e6ff2923d7ff7975e6fff1f0fcff3631d9ff1b1794af00000000aa6100cfd17601ffd07501ffcf7501ffce7402ff5a33017005041b202521caef3631d9ff2923d7ff2923d7ff2923d7ff3631d9ff2521caef05041b2000000000f0c034ffefbe33ffefbd32ffeebb31ffeeb92fffddac2aef2d22093005041b201b1794af2923d7ff2923d7ff2923d7ff1b1794af05041b200000000000000000f1c336fff0c135fff0bf34ffefbe33ffefbc31ffeebb30ffdeac2bef603b057000000000000000000000000000000000000000005e3802700000000000000000f2c538fff1c437fff1c236fff0c135fff0bf33ffefbd32ffefbc31ffdb880cffcb7f09efa36407bfa36407bfa36307bfca7a08efd88107ff0000000000000000f3c83afff2c739fff2c538fff1c337fff1c235fff0c034fff0bf33ffdb8a0effdb890dffdb880cffda870bffda850affd98409ffd98308ff0000000000000000f4cb3cfff3c93bfff3c83afff2c639fff2c537fff1c336fff1c135ffdc8c0fffdc8b0effdb8a0dffdb890cffda880cffda860bffd9850aff00000000000000007a661e808972228fc5a430cff3c93bfff3c739fff2c638fff2c437ffdd8e11ffdd8d10ffdc8c0fffdc8b0effb26e0bcf7b4c078f6d44068000000000000000000000000000000000000000001f190820b7972bbff3c83afff3c739ffde9112ffde8f11ffa66a0cbf1c120220000000000000000000000000000000000000000000000000000000000000000000000000000000002e260b307a651e8070490a802a1b0330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff00000000000000ff00000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000c00000000100010000000000000300000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ff010000f8000000f2000000e2000000c200000082000000820000008000000080010000807d000080010000800100008001000080010000f00f0000fc3f0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff000001000000080000000400000004000000340000000100000000000000010000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32\ = "C:\\Program Files\\ExplorerPatcher\\ep_weather_host.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Interface regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\DllSurrogate regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\ = "IEPWeather" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 2384 taskkill.exe Token: 35 1340 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe Token: SeShutdownPrivilege 3192 explorer.exe Token: SeCreatePagefilePrivilege 3192 explorer.exe Token: SeShutdownPrivilege 3192 explorer.exe Token: SeCreatePagefilePrivilege 3192 explorer.exe Token: SeShutdownPrivilege 3192 explorer.exe Token: SeCreatePagefilePrivilege 3192 explorer.exe Token: SeShutdownPrivilege 3192 explorer.exe Token: SeCreatePagefilePrivilege 3192 explorer.exe Token: SeShutdownPrivilege 3192 explorer.exe Token: SeCreatePagefilePrivilege 3192 explorer.exe Token: SeShutdownPrivilege 3192 explorer.exe Token: SeShutdownPrivilege 3192 explorer.exe Token: SeShutdownPrivilege 3192 explorer.exe Token: SeCreatePagefilePrivilege 3192 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1340 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe - Suspicious use of SendNotifyMessage 60 IoCs
pid Process 1340 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe 3192 explorer.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3192 explorer.exe 3192 explorer.exe 4308 StartMenuExperienceHost.exe 3428 SearchHost.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1340 wrote to memory of 2384 1340 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 89 PID 1340 wrote to memory of 4164 1340 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 92 PID 4164 wrote to memory of 5352 4164 cmd.exe 94 PID 4164 wrote to memory of 4524 4164 cmd.exe 95 PID 1340 wrote to memory of 788 1340 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 96 PID 1340 wrote to memory of 4648 1340 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 98 PID 1340 wrote to memory of 4400 1340 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 100 PID 1340 wrote to memory of 2196 1340 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 101 PID 1340 wrote to memory of 3192 1340 2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 102 PID 3192 wrote to memory of 2604 3192 explorer.exe 82 PID 3192 wrote to memory of 3428 3192 explorer.exe 106 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:5352
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:4524
-
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:788
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:4648
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:4400
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2196
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Downloads MZ/PE file
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4308
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3428
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\ExplorerPatcher\WebView2Loader.dll
- Size 153KB
- SHA256 fb82ac089963e1dee932acce2f86ba34c128770cec4b60bcfd86f95d29e971ab
- MD5 75bf6c40545560e5013313655b110b93
- SHA1 b18559fae335597b4e2a679277c4d207fa7849a4
- SHA512 da9aaa565b97ea9588bcae6a490eb95f8fae2fa0ed417ede71690462a27d31c4eeb3ffb62c112b9f5cc8832427d450e6417144c928d7e5ead291e7be499f77c3
- SSDEEP 3072:dB2orIvLgMJr6lZXLFw4LZat/ToEtANePgUcOtd0:+vLgMZ6vbFwWEtAN6be
- TLSH T19AF35B5BB3E4107BE1A79274C5A34606EB73785107619BEF03A442691F237D8AE3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\en-US\pnidui.dll.mui
- Size 7KB
- SHA256 ae0d2655cb9806b5c16b92f82d698f5c98feaef1f78ebdd6014dccc8304184ed
- MD5 2ad025b8134ba57ff2bf8fadc8c09b41
- SHA1 4e741e5f0bec8c27cf732ba1be743fb243829e7f
- SHA512 fe20e5e6b9dd233b6361b5fc8d1aed3b4ce80f81b5c113e8c242d0c89d3c127013ba28dc650b24535aa43b85f4a2c0f9a82ae9b6c12dd0be55683329cc92aa00
- SSDEEP 96:rjJnlkt+jW52ujTJeEggdh4W43WR5c2g3WLoRzskKp1ExEWkhWw0E:/bkt+8jPeskKdWkhWg
- TLSH T169F1120263FA0509F0F36F3059FB62544F7ABC6279B6CA6E8780505E1CB0A549E60BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_gui.dll
- Size 1023KB
- SHA256 3a5dbd13e171e011493bc3fc348ac728caa8fed990c444bde28530800321932e
- MD5 dfa19475d930619ce9a5f3666e63a6e3
- SHA1 8fa285a005958b9f548420fb902b986f446649b8
- SHA512 c0d27c955d23af5b11a68fce27e8d6dfd74e3f361982e4a15ba1ae7a77e5befdb511bcd6eef64757c24700da5f950fad3356c417035892c438784ff708f2ccca
- SSDEEP 12288:Rieenf5wwzElZ+XH7UccuascG3kSCbGInePzqgCL:Rieenf5wwzE38Uc9lcG3caInePzqg
- TLSH T13F257F0167FB0219F2F3AF746DB652818A7ABDA6AE34C58F0250555D0D35FA0CAB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_taskbar.ge.dll
- Size 9.3MB
- SHA256 5a0bf1c881c52ca4b57b2ea6f007ed570c08324da740c3d9d860a02f0242ed54
- MD5 e23adaca46454043f83ec2c3b4ec5f3c
- SHA1 7c6ac3113dbf20cbcc6a9798c6044594c9be2557
- SHA512 b8ece2b76a45a44f696776c1b95ea6e2bd59edbb9930924aeba97ed0ba88ac7028de7e1c681a5c19767c67558bf0122d58ae7cb47c7cd02f750eafd80da69770
- SSDEEP 98304:JMjZbbm9QIasKJfu1OJKFtSzo900YQ2fo623K9K0kgMr47ojk22FBDK:cbs+K/Mw0Pkvqojk22vu
- TLSH T167A6070273F94148F1B3AB38DCB787559E36BC926A31C24F1264766E1E327919E39336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host.dll
- Size 242KB
- SHA256 e5f60642fe2d8e1c9d742af831a640e7baafd8a8d6212f04670ce264834b3e11
- MD5 c73d2124d1571830056f11a51fd02134
- SHA1 802163f5ed6ca86e3d35d6cba24179fdf88e20be
- SHA512 6a5989982ec6074d517123d3dc6540e131eea238ef01045d5c2a7049b66a6bd184b25076875305bfce574a8cb70a21145771f7ca5a4df69ff26f2a8156f70749
- SSDEEP 3072:gqeAqGfYQej0qAPP1+YCflwUnMlKiD/FparFdGnkm+Cm7S9kEXB9aosywy5+7WLW:giYBUgpFub3oxM5OS
- TLSH T19734175477E50569FAB76B388AB35546D633BC565B30CBCF02A4420D9F27BC0983AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
- Size 107KB
- SHA256 fde96f8f288cddce13617744822312798d8bae69b12b7fe04560322c78469572
- MD5 f82947d21de1408b2deae67a4ad65694
- SHA1 973b2f64c02d7fa9e947457230ce5d31722551f6
- SHA512 4e09644b165f8fcc43b623edd0224d24019e81f024d6ef889c068ae21856eaa11f7a367adcc2fd88447349f2c4f4fb84f2341638502165148a58e01a96920d0f
- SSDEEP 3072:qs8lNqxkYbVKe9124fx6LvKVbZaZaZ8XWTwc8eZJQI:YqxfbMcTfx6rrAZ5
- TLSH T14DB3494BA3E540BBE172967884A30A45D772FC0117A15FEF03A4621E1F337D59E3ABA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\pnidui.dll
- Size 2.0MB
- SHA256 52e9c88cb50ef98e683839ab62880180f0dd3db3e1c445ea461ae63d97a349d3
- MD5 2f913bfdcf1fa8dc441aa48b508b3a09
- SHA1 6a832e3d222698aaf7b1176438387eb25a47432a
- SHA512 8b0c0ce642de3a86f0d1b2c50989e15de5f53d1a6eacc69bc69b2dd4f617bc62e1464602ad22282674a0385f0dfc85dd8eb03041b7ff6c5a9af13afd46a570f9
- SSDEEP 12288:07b3ZyzzfW8ZDhJ8wfm24wx8Zc0dDshhv9FrsEC:wZyzzf9DD/e24wx8qKsX9h
- TLSH T19EA5531D7767C056E0156A7C9CAFC1F85E12FC25DE2091DBB290BB3F3973A88B426684
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
- Size 1KB
- SHA256 31df4b0fcc5a818efcdbab276065f10cb04709e240dcd5ccadfed12b6e2595d6
- MD5 d3d73a9d5036aa17c9320d7d722f7ba1
- SHA1 b54ef4a3d502acaca84f8ef5a4ff7fe31fef99b0
- SHA512 739da91836c0e992b56259449b39aa8ba8182b74b9eb38a502710251cbef5507dff3b3a7dc5e75b3cced878dcc4c63f5f9b849afef8a1c4d57e7ec6c0001c52e
- TLSH T104418B0D23E15315D3728E376CBA96168176FC1AED2A8F7D84C562C12C34200E831E2E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartDocked.pdb
- Size 19.2MB
- SHA256 f3ae7a839a71d71777e73dcef2c746e50de817f7fc55b693f442921db8f50672
- MD5 ac6b6d7ad98c42d848df73cc0e7c5006
- SHA1 53f82a5fea00734f9d32b3871a4a8fcca9da8d3e
- SHA512 2093c8f4f4e67422a2e81968678084fab699f90de0f49f33c93bf47eb968c1fa4d1a3716f2d6901210ade62a71c1b3f4dac8c0df328406df75e392a0f60dc76f
- SSDEEP 49152:6mdWc7jxfK1k009VS2UZB4ErL0PK2kyvlWPfGkq6kvxh2yX3N3F3O3N3n3LeO6Q3:OSkPsOG6
- TLSH T1CE17B42071F665F7F2BE073741C6434C1A7051D357A289EB992433542EBB281DBAB2BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartUI.pdb
- Size 34.0MB
- SHA256 7bf15ec5f19f0b2d35149ddf642ea08e528b178e2c7145982e5a8a8a1f5ddddf
- MD5 e102eddea71961b0d4af9bec446ece07
- SHA1 fd4cfbe1216a70d4610367f292fa11aa350c8040
- SHA512 d17274c4beadc23bf67e1878a30194d99c3e4ca707f51e6072d3f7e7432da12d96d7ede4d23be08576b8ac764610aff27683ed4046e1b2bf41de84066ef149b9
- SSDEEP 196608:vPcF1Vbv8dJ6EPigdurTKKR68aMfUDCaN4QlkqYGxR2rlP9rKoyEXv/uIqvLzfHg:00joJ
- TLSH T17177D619716762B7E1BB0B7B4DC64309137151A357E38DAB192132342CBB341AB8F6BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\explorer.pdb
- Size 2.9MB
- SHA256 d1a3b2eae2fe59758dae319da8d274b25a288ebca63b26ccb4fd8d1f2a27d114
- MD5 7ae13d4f0144d0c91aed5f37a7d49b64
- SHA1 4fc85c1e0ad8ed30efb9e52fc39c77036c2e1d47
- SHA512 5d5ba4118df535020947fc5cb247d237663d236bdb2ce86b3d58502784b017576ebc16a594ab6959a22aa595a3df6361a965d53540382ba42452b4c391b5de1e
- SSDEEP 49152:GISzUWGT1gV544+MfutyEoZ5eNmklItrv:GIEThR3Z
- TLSH T162E5295273E750A1CA3F17B2A0178389EBB69953239187EB3C2673A21CC3142EF5F655
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
- Size 27.4MB
- SHA256 7a74f35cd9d0069325463b918e9cd6272bf1563608202d99a21742dedabb1d45
- MD5 476cfdaa7da7a868cac3fcb1a3bcc718
- SHA1 740b3434f0ae9f581787fa4fe23513b9bcd065cd
- SHA512 f74b02f59a67d21a4cd1567b33e9d53f7dabf50554865f594c04e8e40399b22bfc274739e22bb7213270c21729474e0d8761cc71beb1257476af1b59b74cc473
- SSDEEP 49152:sGDBmCileB++IGHaJ84trubfLVY5UL86TJUXysPGVzlGWcuJdSmV5odM/YJWVliW:ACiy+dG5GigUgjSMVgF
- TLSH T13A570A6373BF10A1D9BF6337818757996BB6425356C2C66B253633229CC72878B8B34C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll
- Size 8.3MB
- SHA256 715b75b289dd2efc34fb0ffd924fcd38a34fee9fc5e93a207fcada7cb38f6508
- MD5 20b55d5c6dce22f8011906281e4e6999
- SHA1 27735ead648e104d3715dabfcfff410cdcfc706c
- SHA512 87ce3569c9803380f31638c181f5c9d3bd1bba497d162405ef0d0271abef1fc91badaaeb8d79c30f8ee0f5313bf8dda161bec7de0a57e1f4bf10fcabb3d28db2
- SSDEEP 49152:mcvhib+lfmq53jlhFdDRqzVUW+qn47Y1sqjQ7y9GVshaTBLHiNLbEr1zIcmQn9aD:mCjdCQ1zIWx5KDegEgHnrQV
- TLSH T18F96395D15AC0A91E0ABA8BD88F31A0BF9713D9A9770C6C7447443741F2B3F6987E392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.DLL
- Size 167KB
- SHA256 172a7d57e6ebe47c19463ee00a826ca1709693aeb6ed546c0fde7b607c850a14
- MD5 f0cea45a016efc1914abbce867b87f9f
- SHA1 d0d68b60142d39540efff713b7aba66161454866
- SHA512 08c9db36c625e6c21ab13c86a40a5bc7aa165f018eef91bd9d44e109fab6c2e241a6f0a95d1b121a015008101cf5d73f8bef7b58fd4d0a6eed812c034f6f4826
- SSDEEP 3072:UcOkQjDyJxgroPXk2bAWpSAptOojv6a+zzeM:CDaackUvpJQv
- TLSH T100F3E70372F918AFE0B346364AE352155A7678110B53EBDF425406962E273E1AE3DFB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\dxgi.dll
- Size 629KB
- SHA256 d4ff82c450936e5832b3e658ae912570ae63699d64b980d8b137cb562440e35c
- MD5 b2e12495abb1fcf356d29e9cbdf39708
- SHA1 1fe95e63eee01b780ace3d9f7220d907aa91ef3b
- SHA512 e68a2dbae0db3e4960821f0f5403bd676b08e80169d004c3b9a271f4b5f38213000382903392b08a13ae63c0c540d271351f241eb09ebaae81d7c11799e61396
- SSDEEP 12288:Yp0Oejd7iLgnNvWVV1ne47GaFmb49cf98uI:2k2ENvgV1ne47GpVV8u
- TLSH T130D45B1267F510B8E4BBC679CAA34112FB727C521760DB9F0250855E6F33BA58B3E722
- MD5 SHA1 SHA512 SSDEEP TLSH