60593ced1e78fd4b3fdffcd58bcde989d8e9b031b3ad9132815fdf614e0449d4

Resubmissions

02/08/2024, 17:06

240802-vmmrcsscqn 7

02/08/2024, 17:01

240802-vj1h2ssbqr 6

02/08/2024, 16:56

240802-vfvhmaxakd 7

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-es
resource tags

arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02/08/2024, 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CeleryInstaller.exe
Size

822KB
MD5

0bd82e264be214414d6dd26bac3e1770
SHA1

5325e64053dcf599a9c5cedec532418716f9d357
SHA256

60593ced1e78fd4b3fdffcd58bcde989d8e9b031b3ad9132815fdf614e0449d4
SHA512

842a80fed2286d06987cd2dde7ae94fc6c7986eb49cc62684f62f148973e5080df7866e1d2f81d53cb5ac95ef9d88489f6765265e29104be0ae349c6a3164592
SSDEEP

12288:c5SsIg0ZvkY29slOLJFbJZXM1Eg/2QAu4NRFNxIg0Z:Ru0ZvkY29+OLfzI2Q0NH10Z

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	CeleryInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4916	CefSharp.BrowserSubprocess.exe
228	CefSharp.BrowserSubprocess.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CeleryInstaller.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	CeleryInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	CeleryInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	CeleryInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	CeleryInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	CeleryInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	CeleryInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	CeleryInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	CeleryInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	CeleryInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	CeleryInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	CeleryInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	CeleryInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	CeleryInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	CeleryInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	CeleryInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	CeleryInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	CeleryInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	CeleryInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	CeleryInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	CeleryInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	CeleryInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	CeleryInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	CeleryInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	CeleryInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	CeleryInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	CeleryInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	CeleryInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	CeleryInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	CeleryInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	CeleryInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	CeleryInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	CeleryInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	CeleryInstaller.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	CeleryInstaller.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4940	CeleryInstaller.exe
4940	CeleryInstaller.exe
4940	CeleryInstaller.exe
4940	CeleryInstaller.exe

C:\Users\Admin\AppData\Local\Temp\CeleryInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\CeleryInstaller.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4940
- C:\Users\Admin\Documents\Ce\Celery\Celery.exe
  "C:\Users\Admin\Documents\Ce\Celery\Celery.exe"
  2⤵
  PID:3976
- - C:\Users\Admin\Documents\Ce\Celery\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\Documents\Ce\Celery\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\Documents\Ce\Celery\cache" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\Documents\Ce\Celery\debug.log" --field-trial-handle=1984,i,18394681359456046403,17494434591211001922,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2 --host-process-id=3976
    3⤵
    - Network Service Discovery
    PID:228
- - C:\Users\Admin\Documents\Ce\Celery\CefSharp.BrowserSubprocess.exe
    "C:\Users\Admin\Documents\Ce\Celery\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\Documents\Ce\Celery\cache" --cefsharpexitsub --log-file="C:\Users\Admin\Documents\Ce\Celery\debug.log" --field-trial-handle=2476,i,18394681359456046403,17494434591211001922,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:3 --host-process-id=3976
    3⤵
    - Network Service Discovery
    PID:4916
- - C:\Users\Admin\Documents\Ce\Celery\bin\lsp\main.exe
    "C:\Users\Admin\Documents\Ce\Celery\bin\lsp\main.exe"
    3⤵
    PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\Ce\Celery\CefSharp.BrowserSubprocess.Core.dll

Filesize
1.1MB

MD5
5b745ee879e65f7a47c56265881f16e7

SHA1
e6a90771b8f1bf53beeb7c9e4268756ff07a088d

SHA256
c8944a83938c39fbea72700485db8a61ab82e1c51d8e16d5dd48de4e36a6f264

SHA512
3b4bef98a1f751c3a747de0eb050828bf8474efa68aa7a26d0369f1c3b42829eaab221cb612c005a54ed5b84f19180700e51aab39adb84fe7246d9e91e6899c8

Download Submit
C:\Users\Admin\Documents\Ce\Celery\CefSharp.BrowserSubprocess.exe

Filesize
6KB

MD5
bcd22b9511d5383e23d875e2cf3c339e

SHA1
0ef86afaef536cc4b046ea2866414bb193d60702

SHA256
95dd31f11ac1317559b6eee0479739930d503a4938283f5d831ac8add92ad792

SHA512
c4e6821858720895c0bfae797097e3307bb7ea8f03dde4fefc16cce03b2a50fecfe8ed5c3225136fcd9d74ee0ed8673f795b410cd14890d22df58c1f03b693c6

Download Submit
C:\Users\Admin\Documents\Ce\Celery\CefSharp.Core.Runtime.dll

Filesize
1.7MB

MD5
21719cf581f5cc98b21c748498f1cbfe

SHA1
aaada7a02fadcbd25b836c924e936ce7d7ee0c2a

SHA256
6fd2685e02ef7c92ba5080faadb44f22fee528713f5101e2841c1230cba691e6

SHA512
6394ddabc7ad03895ecddb9943371935e0a2320e933b380a563eaf03d1a039c7180aee763834170c85485416b1af38b55c1dafff7311b25513369b01dce22598

Download Submit
C:\Users\Admin\Documents\Ce\Celery\CefSharp.Core.dll

Filesize
897KB

MD5
16f8a4945f5bdd5c1c6c73541e1ebec3

SHA1
4342762c43f54c4caafaae40f933599a9bb93cb5

SHA256
636f8f865f23f2d47b73f3c16622e10b46437bbf7c89b0a2f70bae6129ab046a

SHA512
04115c425c3015ee4355cde2a6e5e28ec24745ea77761a40c0986b54dc14bc67cb142986988d79df87e75ea54d21ded9384842e01cf0714b84f7378e6a13400d

Download Submit
C:\Users\Admin\Documents\Ce\Celery\CefSharp.Wpf.dll

Filesize
114KB

MD5
36946182df277e84a313c3811adac855

SHA1
bcd21305861e22878271e37604b7b033ec347eb3

SHA256
8507a4662220eca49d7d511183be801cd394f13dc0e9898c55361020fe9a4720

SHA512
80b1e947b1940dccfe5be8a1ba1e8c1d9eacb122d73724a21233164f5b318fa57c249256f621f0f9c1e6a9e4c902eec58827bb899e20f2990f4ade1d685f1abd

Download Submit
C:\Users\Admin\Documents\Ce\Celery\CefSharp.dll

Filesize
272KB

MD5
715c534060757613f0286e1012e0c34a

SHA1
8bf44c4d87b24589c6f08846173015407170b75d

SHA256
f7ad2bbbeb43f166bbbf986bdb2b08c462603c240c605f1c6a7749c643dff3fe

SHA512
fcaec0c107a8703a8263ce5ccc64c2f5bfc01628756b2319fde21b0842652fbeee04c9f8f6d93f7200412d9bd9fad01494bc902501fb92e7d6b319f8d9db78d7

Download Submit
C:\Users\Admin\Documents\Ce\Celery\Celery.exe

Filesize
4.3MB

MD5
5a057f600097db9b92c5fe56250952d9

SHA1
5995176681720e2342ddf55962dd0a800d27c249

SHA256
8cf7958a99ba69b8311205081d8316f059714ca27f0c0d39dcfd09c897720d05

SHA512
e18aa72653371fb3f334bd03cac5cffdf9c0e7607947f99e8a27948655ab8033418ebde458bd58f8b4b58cc7c0e8a965d3523262d931aefeae71b71bd4ad20a4

Download Submit
C:\Users\Admin\Documents\Ce\Celery\Celery.exe

Filesize
3.0MB

MD5
93f3965aeb0f8a8a909fe77d3ab8642a

SHA1
bfed0cd62d4afd908d72bca9f0ef6d93acb61292

SHA256
af02f4b4162548dfec5174153c263a625d4cc513c3e1d5d8ddfe934371b4e6ab

SHA512
4f57ed32d13d8e71e6832129f229b02db371170de201d3ccf7b4c6f7a4314b5be0d1a6ce9e3b85d858eada1bc9ed66414697d7339285410a5af34113f78ff779

Download Submit
C:\Users\Admin\Documents\Ce\Celery\Celery.exe

Filesize
3.3MB

MD5
62f75260e933c5810b35b65a23e3eb41

SHA1
4cfcf7e71d66b841c4ab7a66c2b2a7ac1aebadf5

SHA256
2e324ef875636be14077d765d72c247e9ab537a754f1ed6045f7cc9d131024c9

SHA512
3bc076f8f0c583a6d744a7910380bf8c06ac005ec9df74e8c51268e4a6a00451ad65442042ab8dbd67da53eff13081a215f6a81be6a9603174b6329735cc7ecd

Download Submit
C:\Users\Admin\Documents\Ce\Celery\Celery.exe.config

Filesize
189B

MD5
9dbad5517b46f41dbb0d8780b20ab87e

SHA1
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

SHA256
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

SHA512
43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

Download Submit
C:\Users\Admin\Documents\Ce\Celery\D3DCompiler_47.dll

Filesize
2.1MB

MD5
07b8291d047c119ba4766f2018dc8ce9

SHA1
e9912c8f85d5623c27b54b250d516846c759e33c

SHA256
3dbef6dfb24e8a6493077e4e093fb7f04c47d389e191fcd7b889b923298b9a4e

SHA512
b7770d5651c82a23010c571bbc401c619d1afbb6c3ff5ba1ad8b5e1d846b2cfe44f53871d502228603d788de610d9399964b05dcfc349c6d1fb406f21b9825bb

Download Submit
C:\Users\Admin\Documents\Ce\Celery\Microsoft.Bcl.AsyncInterfaces.dll

Filesize
26KB

MD5
ff34978b62d5e0be84a895d9c30f99ae

SHA1
74dc07a8cccee0ca3bf5cf64320230ca1a37ad85

SHA256
80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc

SHA512
7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28

Download Submit
C:\Users\Admin\Documents\Ce\Celery\Microsoft.Extensions.DependencyInjection.Abstractions.dll

Filesize
62KB

MD5
00053ff3b5744853b9ebf90af4fdd816

SHA1
13c0a343f38b1bb21a3d90146ed92736a8166fe6

SHA256
c5a119ec89471194b505140fba13001fa05f81c4b4725b80bb63ccb4e1408c1e

SHA512
c99fcda5165f8dc7984fb97ce45d00f8b00ca9813b8c591ad86691bd65104bbb86c36b49bb6c638f3b1e9b2642ec9ac830003e894df338acfca2d11296ff9da4

Download Submit
C:\Users\Admin\Documents\Ce\Celery\Microsoft.Extensions.DependencyInjection.dll

Filesize
94KB

MD5
3452007cab829c2ba196f72b261f7dec

SHA1
c5e7cfd490839f2b34252bd26020d7f8961b221b

SHA256
18b39777ee45220217459641991ab700bc9253acaf0940cf6e017e9392b43698

SHA512
a8b83a8582dfee144925a821d09c40f5730f6337b29446c3bce8b225659bdc57a48778081fa866c092d59b4108c1d992e33f9543ae2b4c7554b8ff27b5332cdf

Download Submit
C:\Users\Admin\Documents\Ce\Celery\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\Documents\Ce\Celery\System.Threading.Tasks.Extensions.dll

Filesize
25KB

MD5
e1e9d7d46e5cd9525c5927dc98d9ecc7

SHA1
2242627282f9e07e37b274ea36fac2d3cd9c9110

SHA256
4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6

SHA512
da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

Download Submit
C:\Users\Admin\Documents\Ce\Celery\System.Windows.Interactivity.dll

Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
C:\Users\Admin\Documents\Ce\Celery\bin\Monaco\assets\theme.json

Filesize
390B

MD5
53140e18fb33e7e9a25e13f57a4190aa

SHA1
dd72190319ae2b7ddb12a137f50fad2579fcc897

SHA256
1cbd08945e5e8612b690e1eb663917cfb4f84f0083bf7d2c2a61f43e6c455e9b

SHA512
fb9b0456c7c9d468b14db242659d2cda36f7457f9035628d92538850a509e78116972e9890edc3b69d4379aaafb6da76ff2876b446b6953e14914cdfe7dc7b94

Download Submit
C:\Users\Admin\Documents\Ce\Celery\bin\lsp\main.exe

Filesize
2.6MB

MD5
3e3b2a4a40bb0a27ca9bb8dd8896b813

SHA1
4873a59c0f5f6a02daf8d751768806adef3f3162

SHA256
17f8c490e26cb652a5d75be83a62e2376b0070c93c0bfd8c2e5de578380872d3

SHA512
bc99be7dbb79f21ab0109e4b82cf7c151db83cf9b0ca548d96fa6577609f099bd935fc23374e405c60af0b6360c5cd89b40a04bc4e4ba4bce50f4eaff8c1aa63

Download Submit
C:\Users\Admin\Documents\Ce\Celery\bin\lsp\main.exe

Filesize
2.1MB

MD5
41cffe1e5ea438535fd5c7dafbba6eff

SHA1
375bf030808225c16cc64a83e305769abfb9e405

SHA256
ca34d5efcad920fbd1ca117137a13f0a7f1e3603ea102ef205f0dc80dc83ba95

SHA512
202c4ef008b24197200094021a86dbd973f8f26c660d7607d168f96c718a71bb8376a38b3b563ed7eeda133de61cf77b084ea11f16c35072883dcacbfb1d4407

Download Submit
C:\Users\Admin\Documents\Ce\Celery\chrome_100_percent.pak

Filesize
682KB

MD5
d3e06f624bf92e9d8aecb16da9731c52

SHA1
565bdcbfcbfcd206561080c2000d93470417d142

SHA256
4ee67f0b0b9ad2898e0d70ddfad3541fbd37520686f9e827a845d1930a590362

SHA512
497126af59961054155fbb8c3789d6278a1f5426000342f25f54115429ff024e629783f50f0c5350500007854712b07f7d8174ecfe60d59c4fdd5f3d72dac262

Download Submit
C:\Users\Admin\Documents\Ce\Celery\chrome_200_percent.pak

Filesize
1.1MB

MD5
34572fb491298ed95ad592351fb1f172

SHA1
4590080451f11ff4796d0774de3ff638410abdba

SHA256
c4363d6ecfa5770b021ce72cc7d2ab9be56b0ce88075ec051ad1de99b736dbbd

SHA512
e0e7deccb26b7df78d6193750bfb9aad575b807424a0a5d124bd944e568c1bb1ae29f584246f753d619081a48d2897815145028ffedd9488e9a8f102cdc67e2f

Download Submit
C:\Users\Admin\Documents\Ce\Celery\chrome_elf.dll

Filesize
1.3MB

MD5
5b3802f150c42ad6d24674ae78f9d3e8

SHA1
428139f0a862128e55e5231798f7c8e2df34a92a

SHA256
9f455612e32e5da431c7636773e34bd08dae79403cc8cf5b782b0ea4f1955799

SHA512
07afbd49e17d67957c65929ca7bdfe03b33b299c66c48aa738262da480ed945712d891be83d35bd42833d5465ef60e09c7a5956df0a369ec92d3bc2d25a09007

Download Submit
C:\Users\Admin\Documents\Ce\Celery\d3dcompiler_47.dll

Filesize
2.4MB

MD5
d4eed9e3879a2b5ba888efa4023e8e90

SHA1
c63da81ae517bf3d0610b235e5bc7e5c764bd97d

SHA256
73b908293ec7620d02dc1c412b99fbdbb28aa74be7939739d260483db6622c2e

SHA512
a1ce1a6f11f0d9621a92de5d74ca4b84ea5e64a3ad2544a1f486caa29d4b1465b1e34592a30efd8de105e8a2a5ce5fbcc4f9e97028d6503b9b20fcfc666b607b

Download Submit
C:\Users\Admin\Documents\Ce\Celery\dxcompiler.dll

Filesize
2.1MB

MD5
571dbe6719b760601eebde5f7fef7b35

SHA1
6bad3a805c2522add9530e1461ab3412743c1be5

SHA256
fcd2c9ddca34efef880e67dbadde542d3cef9751e43332e1b4faff44386c59d6

SHA512
bbdee211799e770cbbc2afbb85a1154005214c883c5fb0ef5f688aafc8f1985196a1c044af1ddbe564573339c6babc0673e76984dc796ac77f8c3e1378ac955e

Download Submit
C:\Users\Admin\Documents\Ce\Celery\dxcompiler.dll

Filesize
2.1MB

MD5
957b8ac6f462f2ecd99f4b232564528c

SHA1
520b2615ce045f1cce4d96a08c7c555200093218

SHA256
9bb61d7828ed2c3fe8af11b7822279f867766300b78b29852dc1d3e0c1241dd1

SHA512
815c04cd7467dfe154a2130905e15a3aa128b8fe8785565a2be807f7b6ddfcbd99ecd4e7fd55a24074da0400c3ffbfef287293fe36008b5d3d2a9f1defbeacc8

Download Submit
C:\Users\Admin\Documents\Ce\Celery\dxil.dll

Filesize
1.4MB

MD5
cb72bef6ce55aa7c9e3a09bd105dca33

SHA1
d48336e1c8215ccf71a758f2ff7e5913342ea229

SHA256
47ffdbd85438891b7963408ea26151ba26ae1b303bbdab3a55f0f11056085893

SHA512
c89eebcf43196f8660eee19ca41cc60c2a00d93f4b3bf118fe7a0deccb3f831cac0db04b2f0c5590fa8d388eb1877a3706ba0d58c7a4e38507c6e64cfd6a50a0

Download Submit
C:\Users\Admin\Documents\Ce\Celery\icudtl.dat

Filesize
2.1MB

MD5
c4c404d9456b663d70d97c3e26c96291

SHA1
7f2266c66064be50f2b5fa501303e9788413d73a

SHA256
ca4a6f8aaab7e6442baa0c31aff3fb13435638f17061bcefb63be517d0e24361

SHA512
cafc81354441c113907d9cc8bdf14f5b5ced89f9d0071d6412a22490cb7d8084d7c648a22246417d8d69d1102741faf2e0733142eb8732fa9629e55eb1a5e82f

Download Submit
C:\Users\Admin\Documents\Ce\Celery\libEGL.dll

Filesize
459KB

MD5
ce2c45983f63a6cf0cddce68778124e9

SHA1
6553dc5b4bc68dcb1e9628a718be9c5b481a6677

SHA256
9ca8840bbb5f587848e66d08d36cb5eb30c1c448ef49ce504961ff4ac810c605

SHA512
df81a3356168e78d9810f5e87ca86eb4f56e5f0cb6afdb13408b50778a2d8b18c70b02c6348cd7ba59609ab2956d28eed324706eb65d04bce1159a2d8f1e0e8f

Download Submit
C:\Users\Admin\Documents\Ce\Celery\libGLESv2.dll

Filesize
2.4MB

MD5
da36f3c6d72765b55f83593817c66d12

SHA1
8dcb7d1d4555b31c1e28a4fc9692f8eb7d4b449a

SHA256
5d2e9288c38f416888e357b6e2be659cb941c04deed1d74f3464c08f887dd4b1

SHA512
537ea2903d035c6f9b3505a55d710664f55c4298b001648945049848a72a96e542d3dc0e630eb2ec3af0912eaf2607509eef124086812780576eabc0a3c68972

Download Submit
C:\Users\Admin\Documents\Ce\Celery\libglesv2.dll

Filesize
2.1MB

MD5
ec6d7a31ff4b955818ac67c45a746d65

SHA1
b9c5e649780b93d3ec5a4ed3811d8e044392e570

SHA256
b1cb1df27718e91752cb56cf964e53273f5276bcc70a2e5de7d3c39cd7119931

SHA512
19ae55b6dca306e2717567559701b124b34084b3d9842442a967e9b805c31944e9638a0a312822a6d3843d564adcbd89a544dfc9fd701242bc2f1bff9209487d

Download Submit
C:\Users\Admin\Documents\Ce\Celery\locales\en-US.pak

Filesize
455KB

MD5
a8d060aa17ed42b6b2c4a9fcbab8a7e1

SHA1
16e4e544eca024f8b5a70b4f3ca339a7a0a51ebf

SHA256
55e4ae861aa1cacb09db070a4be0e9dd9a24d2d45e4168824364307120a906b2

SHA512
8f3820e3c5aca560344a253d068936bdb797d07eb22711020d287a949c97d7a98879ff9ff5a4fb2f3fe804bf502300b6f4c92918d973bef351d587483bc43723

Download Submit
C:\Users\Admin\Documents\Ce\Celery\resources.pak

Filesize
2.1MB

MD5
2d5bea728d874feb4259df3fe56d83c0

SHA1
bbadc27a708670d6e371a3ba0b9420698eb6e606

SHA256
7b3b569afff2042d9a9da748d4be2f99a17f3e865bab14bda0f3abf0fff99b21

SHA512
850090edd0cacd320af80d649dd00a98c53cc6d2354d981faf78b25b4fbd15a8a6fe86ac238c8a09c36644230ace3beb56a41d043d7b7c743a9d83bcfabc6419

Download Submit
C:\Users\Admin\Documents\Ce\Celery\v8_context_snapshot.bin

Filesize
672KB

MD5
12c20b1ea7dccafb8250e13e46bc9914

SHA1
6ed3625dffea1ad3e1aceae4c55caaf195fd7c18

SHA256
5591258720aed178de57b4e61eb59b2c4af2566caa1d18a7157cf8d0feca11d7

SHA512
e520e67eba1dcf236a0daf43ec57182821b1e9142592ef471c724caf74292ed85291bd3b84fef6107ee2c258f93ea4fff2df18485537d73ddfd973b863c76727

Download Submit
C:\Users\Admin\Documents\Ce\Celery\vk_swiftshader.dll

Filesize
2.4MB

MD5
d2653270c9150d8025cd4915e0aa0675

SHA1
395815e4e7fe36b6cf91ebf9622a6e4e5e622b2d

SHA256
c21d2acc27eb26ead75538d73446c843c2b48b70548cd6ea60ac8b914d0e0f94

SHA512
4b2852842e14ec83e69fae1c7de00ad006eb54808ffd6e7bcc5a364ac4ee04a937d120db8a2e067e3bdd1ea1242e3503e498b5d984bddf53b58ccd70afee14cf

Download Submit
C:\Users\Admin\Documents\Ce\Celery\vk_swiftshader.dll

Filesize
1.9MB

MD5
ab4015c407f5cfdab4beb87865f86c35

SHA1
7586326a529d8aa547e2749400a5e658be761158

SHA256
50e322c7ed6958ed1e3ff7d581133797b02fa012644c462b85b43936f46c48f0

SHA512
8b2043ea4df79a4de4e5e0caf8d0a0d081b582d0a836aa47f7ba82b4ff98c52fa6cf055381d25b5bbf16b7e1799740e66235acc096787ad78d0935165e3ac4f2

Download Submit
memory/228-255-0x000001C9F0190000-0x000001C9F0196000-memory.dmp

Filesize
24KB

Download
memory/228-264-0x000001C9F2600000-0x000001C9F271E000-memory.dmp

Filesize
1.1MB

Download
memory/3976-223-0x000001CD9F040000-0x000001CD9F054000-memory.dmp

Filesize
80KB

Download
memory/3976-439-0x000001CDC8550000-0x000001CDC8652000-memory.dmp

Filesize
1.0MB

Download
memory/3976-444-0x000001CDCBB10000-0x000001CDCBB48000-memory.dmp

Filesize
224KB

Download
memory/3976-445-0x000001CDC8700000-0x000001CDC870E000-memory.dmp

Filesize
56KB

Download
memory/3976-241-0x000001CDB8FC0000-0x000001CDB900A000-memory.dmp

Filesize
296KB

Download
memory/3976-443-0x000001CDC86F0000-0x000001CDC8700000-memory.dmp

Filesize
64KB

Download
memory/3976-225-0x000001CDB8F50000-0x000001CDB8F6C000-memory.dmp

Filesize
112KB

Download
memory/3976-227-0x000001CD9EF70000-0x000001CD9EF7A000-memory.dmp

Filesize
40KB

Download
memory/3976-441-0x000001CDC8680000-0x000001CDC8688000-memory.dmp

Filesize
32KB

Download
memory/3976-423-0x000001CDC8410000-0x000001CDC8432000-memory.dmp

Filesize
136KB

Download
memory/3976-447-0x000001CDB9300000-0x000001CDBA300000-memory.dmp

Filesize
16.0MB

Download
memory/3976-440-0x000001CDC8690000-0x000001CDC86B0000-memory.dmp

Filesize
128KB

Download
memory/3976-213-0x00007FFD8B653000-0x00007FFD8B655000-memory.dmp

Filesize
8KB

Download
memory/3976-229-0x000001CD9EF80000-0x000001CD9EF8A000-memory.dmp

Filesize
40KB

Download
memory/3976-270-0x000001CDC7C70000-0x000001CDC7C7A000-memory.dmp

Filesize
40KB

Download
memory/3976-269-0x000001CDC8980000-0x000001CDC8992000-memory.dmp

Filesize
72KB

Download
memory/3976-221-0x000001CDB9040000-0x000001CDB9126000-memory.dmp

Filesize
920KB

Download
memory/3976-408-0x000001CDC8BB0000-0x000001CDC8BF6000-memory.dmp

Filesize
280KB

Download
memory/3976-219-0x000001CD9EF90000-0x000001CD9EFB4000-memory.dmp

Filesize
144KB

Download
memory/3976-411-0x000001CDC8CC0000-0x000001CDC8D72000-memory.dmp

Filesize
712KB

Download
memory/3976-217-0x000001CD9C180000-0x000001CD9D2CE000-memory.dmp

Filesize
17.3MB

Download
memory/3976-233-0x000001CDB9130000-0x000001CDB92F1000-memory.dmp

Filesize
1.8MB

Download
memory/4940-216-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4940-3-0x0000000005880000-0x0000000005982000-memory.dmp

Filesize
1.0MB

Download
memory/4940-12-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4940-13-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4940-14-0x000000000A1B0000-0x000000000A336000-memory.dmp

Filesize
1.5MB

Download
memory/4940-2-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4940-11-0x00000000752BE000-0x00000000752BF000-memory.dmp

Filesize
4KB

Download
memory/4940-1-0x00000000007F0000-0x00000000008C2000-memory.dmp

Filesize
840KB

Download
memory/4940-10-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4940-15-0x000000000A340000-0x000000000A450000-memory.dmp

Filesize
1.1MB

Download
memory/4940-21-0x0000000001100000-0x000000000110A000-memory.dmp

Filesize
40KB

Download
memory/4940-4-0x0000000005800000-0x0000000005846000-memory.dmp

Filesize
280KB

Download
memory/4940-20-0x00000000012B0000-0x00000000012C2000-memory.dmp

Filesize
72KB

Download
memory/4940-16-0x000000000B7D0000-0x000000000BD74000-memory.dmp

Filesize
5.6MB

Download
memory/4940-5-0x0000000008030000-0x0000000008038000-memory.dmp

Filesize
32KB

Download
memory/4940-9-0x0000000008490000-0x000000000849E000-memory.dmp

Filesize
56KB

Download
memory/4940-8-0x00000000094E0000-0x0000000009518000-memory.dmp

Filesize
224KB

Download
memory/4940-7-0x00000000752B0000-0x0000000075A60000-memory.dmp

Filesize
7.7MB

Download
memory/4940-6-0x0000000008060000-0x0000000008080000-memory.dmp

Filesize
128KB

Download
memory/4940-17-0x000000000B2C0000-0x000000000B352000-memory.dmp

Filesize
584KB

Download
memory/4940-0-0x00000000752BE000-0x00000000752BF000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads