Analysis
- max time kernel
344s - max time network
347s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system - submitted
07/10/2025, 19:12
Behavioral task
behavioral1
Sample
sada.7z
Resource
win11-20250619-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target sada.7z
- Size 84.8MB
- Sample251007-xwkpgaxwdv
- SHA256 14aa3643ba7ec062e8886814e6c74904eea5cf9c64c0df6e52d390dee6dbfec9
- MD5 95c2dcf35eba791c77b9511fc01d4042
- SHA1 7bebd04082bba448d320d3be42e8ae23f3a5ea6f
- SHA512 d52eb2ef13ab8c90bbea5b1c5e0ed6f23fd2fe904caaaa05c451c66ee830cbdbc7f3de271732eae05074cfa6cf8d8e393ba936c24d412171f1f0c500e08339f3
- SSDEEP 1572864:Ne9hDbPubfbCGsfjSP9gfmweEcLSRXva01lP64VZZq4fp6aeBdt:NkXuDOGMOw2qC0HZHZXV4/
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 3112 CelestialDES.exe 4340 CelestialDES.exe 960 CelestialDES.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0\MRUListEx = 00000000ffffffff CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" CelestialDES.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0 CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0200000004000000030000000100000000000000ffffffff CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1 = 19002f433a5c000000000000000000000000000000000000000000 CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0 = 7800310000000000d35a19721100557365727300640009000400efbec5522d60475bc2992e0000006c0500000000010000000000000000003a0000000000aeb4de0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0\0 = 7e00310000000000475bc59911004465736b746f7000680009000400efbed35a1972475bc5992e0000004a5702000000010000000000000000003e0000000000147512014400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000 CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0\0\NodeSlot = "4" CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0\0\MRUListEx = ffffffff CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1 CelestialDES.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 0100000000000000ffffffff CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\MRUListEx = 00000000ffffffff CelestialDES.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 CelestialDES.exe Set value (str) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0\0 CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell CelestialDES.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\MRUListEx = 00000000ffffffff CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202 CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 0100000000000000ffffffff CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0 CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1 CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0 CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0 CelestialDES.exe Set value (int) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" CelestialDES.exe Set value (data) \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0 = 5000310000000000d35ab57d100041646d696e003c0009000400efbed35a1972475bc2992e000000405702000000010000000000000000000000000000007dbde400410064006d0069006e00000014000000 CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0\0 CelestialDES.exe Key created \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 CelestialDES.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2928 7zFM.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 2928 7zFM.exe Token: 35 2928 7zFM.exe Token: SeSecurityPrivilege 2928 7zFM.exe Token: SeDebugPrivilege 3112 CelestialDES.exe Token: SeDebugPrivilege 4340 CelestialDES.exe Token: SeDebugPrivilege 960 CelestialDES.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2928 7zFM.exe 2928 7zFM.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4340 CelestialDES.exe 960 CelestialDES.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\sada.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2928
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1492
-
C:\Users\Admin\Desktop\CelestialDES.exe"C:\Users\Admin\Desktop\CelestialDES.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
C:\Users\Admin\Desktop\CelestialDES.exe"C:\Users\Admin\Desktop\CelestialDES.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4340
-
C:\Users\Admin\Desktop\CelestialDES.exe"C:\Users\Admin\Desktop\CelestialDES.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CelestialDES.exe.log
- Size 2KB
- SHA256 245810360fb0989ead6d9ea3e7b1f5e4b9934cc40667c5069427e8c3ba91fdc8
- MD5 1dc92a1e9a6cc255d5c12057084e100c
- SHA1 9f826c54f5fec40f04a13d70d88e2fff8b115284
- SHA512 72d40d3667f61485039b95fa10c2fdfb8de8d7aa90d2ee6f3bdaa0642e739e5c5dd45fcd7541f4036d4fde73966172f731cf3ef736006fa6fa6451cfe279ead7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zE07BE4727\CelestialDES.winforms.RemoteDesk.resources
- Size 262KB
- SHA256 70999136b6f3b12dd607b6e769cf4624beb1648ab7cfe12ea7b11dacff21eb49
- MD5 71e101085d1f2f23cf30aec8a3473018
- SHA1 e26bd7d70659f3e01158fb67b2557998add8efa3
- SHA512 a7cb77621078266bc4c2566f2f3d2e7e22d4c46bb7469fa1a493c1247c1246750bc2a8f0c075f8e1d1cbdfc7b15fb4abad40abcccb1e58cfab94fed106ff2069
- SSDEEP 3072:1u86UWFsGCleqxqqTn96S+b916FLsXrqy:Q+nIb70U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zE07BE4727\Form1.resx
- Size 5KB
- SHA256 9171934a9fe1ba5e9d7739f43506270a487a4950b188fde2d759cd3fbc98b29b
- MD5 75d9ccd0b3e3460ac5922bb077cae7a1
- SHA1 754c43b47d0b4b660d66b0cc834bf7f75a0d56d7
- SHA512 07cacce53773f67abd05e6e98ffe4c2d96169f23b5539a36088b654f2dfe2252c1a35fa0f6978ddf65e1770666181128f68b35614140da337929703ee36bb947
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFzXba2:KjrbLPD9sLvIzSvKgIqUyahFDbawn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zE07BE4727\celestialC.Form1.resources
- Size 180B
- SHA256 e13ed2c59366d0eea74863fd71a81f0cb977cce1edfde304fc538690a4f6ac89
- MD5 cd7dbc7abeda9893ce25793744443958
- SHA1 dbbbbe2694d4b9b990881f279b4313574dbeac9b
- SHA512 e880f131ff460384940248ab2ecd97189ae0b7169fe5246440dfbce32f295cbd7697ce2ee65b434a0e40be91b91c21b2c14b1f446b2b1650d0a5d94c0d4f37ef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\0.exe
- Size 3.8MB
- SHA256 9fa92fe06fd9986ae7cc6a06859f62f8e4ad880ee79da236e92cf2a211293ca7
- MD5 184687d75313ad2bbc3f1e12419fbd3c
- SHA1 969828fec9fb3e8ec7535eca2feaf721a5d2b587
- SHA512 7fc3fdf2bc4169893fe474929b0aa079eaab556d150785724ac16a0cf72c9fdb31ef6cba413516d03d4eb108ffbf4e866db524364833c24d1bdd4621f264c9d2
- SSDEEP 49152:QEnQrBlni9el+/ljOgWOmel0mYyhLnHcBEdecFV:QEnQN+/ljOpOmemm5hLj3F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\1.exe
- Size 3.9MB
- SHA256 2085b69e0f1ec6bc016d8c84083ca0bad2f0ba2f7e1def2e323eba4ec918559a
- MD5 25f103f872b9c46bf5fcfea9d47876e3
- SHA1 6f91771a45579bc1ba01584b686c5fa27f84617a
- SHA512 e3caaaa0d401689db8b80af3d764beb37b4b0b97e3f731605eb5cdf09e0ce187ced07e64a0a46a5d3b0579aafc1b7c3d1e0397de1c1a1f599814aed7124a4585
- SSDEEP 49152:MEnLrBlni9el+/ljOgWOmel0mYyhLnHcBEdecFlA:MEnLN+/ljOpOmemm5hLj3Fl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\2.exe
- Size 3.9MB
- SHA256 87bd82f7a44a4e8ee51f861ff87d13e2097870e36517cd706049aa47e9877704
- MD5 d0d30cb4ade2f8ac4f983f7e0c347108
- SHA1 cd79c95c44468fa529ee86cb275d861bfd44f85b
- SHA512 40a92537400756c5c668bff4bc40cbfb38071b4a91a3e58174aea4824a8afd489b2704542570032c24228cb5687c2a60bca8f0f30f870b5ee8a8070fd238a463
- SSDEEP 49152:/EnxXlni9el+/ljOgWOmel0mYyhLnHcBEdecF+O:/EnV+/ljOpOmemm5hLj3F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\3.exe
- Size 4.1MB
- SHA256 0bd3d6bcc8bcf0f0398bc95e9256b44de965610b368934558fbb2c8ad8e4f3aa
- MD5 25183e1f5532672d4bb56d5d857de57e
- SHA1 52862760498c8ea2f890b9453bc5ec1788bbdd27
- SHA512 c768f27b5956c6935a5e115774085e55f272a181a497308f64b55397754c902d188f3f73035fe85a35bf643ea46531cb7cd3b396723b77f4c49c9c19c2f4e9b5
- SSDEEP 49152:tEn9klni9el+/ljOgWOmel0mYyhLnHcBEdecFOY8p:tEnQ+/ljOpOmemm5hLj3FOB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\4.exe
- Size 4.8MB
- SHA256 00a84664eafa80bd03c0b354bacd7de57835a96b4de6190699430bc644489a71
- MD5 9a9bcebdd558f3e040ed1eedd8302400
- SHA1 800e95efeb8c885c1c15bc3282b56bc695bf3351
- SHA512 b6cbacc34737342c461f9a16f79db5aa27a61ec25aab0e82bb8aaa919d598924f11ed04114c06e90ea4500bae45104256e01b2eab11dd364c3ffbe3ba43b296f
- SSDEEP 49152:yEn8YSJWklni9el+/ljOgWOmel0mYyhLnHcBEdecFOY1:yEncZ+/ljOpOmemm5hLj3FO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\5.exe
- Size 6.4MB
- SHA256 9abeb521df3239a3803a0d73b31723595fca1ffa1f94cfa2767274ca92677048
- MD5 9f1e65e67c2081827fe04a154a1ca0f3
- SHA1 77fe2b1768c0aaac8d1839eccccde6abac98a0f8
- SHA512 7b1b9a17b61074bf36fc24f9ad3c46e3eab7a9e6a13521f00776c888a3ed7a446598f7bb743bc6c7fae087ba2ddb3ff290bb2b6ba3aea8324cf88cb5cd7ea305
- SSDEEP 98304:eEn57aRmyYRJ5dG/+/ljOpOmemm5hLj3FO:J5GXYRJ5dG/+/l+uXPw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\5C.exe
- Size 6.4MB
- SHA256 0a1c4aa7cbad65f8d1b25bdd56d4a1557355a8aaeb66bcd8d39954875a2f9cf6
- MD5 a0ef90e5299caa08e63c25db424bd0ad
- SHA1 e62d4f9282b51935606756832f93e92210a5bbb1
- SHA512 f30362dfade0bacaaa580e2565994edc95b0fa89cc3ae5ffadcfc09947dc92e3b3886d14ffa49b4ec57dd39a2c359a05c7e9ff9d7773f13f45d967ad5385dea6
- SSDEEP 98304:DEnUuWDe+fS0U9+/ljOpOmemm5hLj3FO:QUFBfS0U9+/l+uXPw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\CelestialDES.exe
- Size 3.8MB
- SHA256 131e256134237fd2ac6de4e1fe4ae7447dabddd93965b16950a54d53bc0c76de
- MD5 fabc73a515ee5dc335f94615c50d405c
- SHA1 cbebdc00213ce7e1fecafc1cbeddecf0ff928b62
- SHA512 e980867512fe846881d1ff1f195b571c78c3dae05d4041a060cde7739bc0812566a438ea6adff2722926b1992194c4f081aaf0cacb7dbdc54c313bc20b825ada
- SSDEEP 49152:7g7lni9el+/ljOgWOmel0mYyhLnHcBEdecFeEn:e+/ljOpOmemm5hLj3FeEn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\CelestialDES.exe.config
- Size 186B
- SHA256 7921098e47e894412fdfd0cafe0f88cc68497740998eac17c68c00129069d803
- MD5 b51c130a957051ba9fb2245bf76fb6f6
- SHA1 42181e5745daab2a0e8cf87693142828306f9bda
- SHA512 fa2ac3eff5d51aea7acc9cf6aa018a77fae295d55c5bf808c9d7048c801baf4626568f00fb001a9f2780c46dce294482cfeb3045aabe139ddc557c0d3bc11640
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\Notifications.Wpf.dll
- Size 24KB
- SHA256 26bf458ea96d09e78d9ac1200d2156d9e620e0fec1bda2e7eac6b05c62eb2677
- MD5 f30ef05b403132ea4a9949be8c82f94a
- SHA1 7f6d2d05e5f126a51490af987430d58a80417e45
- SHA512 2bbcf7ec87e4a8ca933116ce86c8f15f98c74c103bdd31f6b55e264bfc07e492aa4b2c271efe7d7dce7e90df882f15de5f26af9ff0137350717ff1c91d0e0059
- SSDEEP 384:OGzTcjcYCjLO0dBjEQu1NjEVXVfLo9yUEwzjVu9e6134xrZtKN8a9dGg/UzZH:tzAjchPOMj21NAPMjQTMXgMzZH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\WinMM.Net.dll
- Size 43KB
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\dnlib.dll
- Size 1.1MB
- SHA256 83445595d38a8e33513b33dfc201983af4746e5327c9bed470a6282d91d539b6
- MD5 de0069c4097c987bd30ebe8155a8af35
- SHA1 aced007f4d852d7b84c689a92d9c36e24381d375
- SHA512 66c45818e5c555e5250f8250ea704bc4ca32ddb4d5824c852ae5dc0f264b009af73c7c1e0db1b74c14ee6b612608d939386da23b56520cac415cd5a8f60a5502
- SSDEEP 24576:m+pL+hwfQvqx+yLjynb1YNzh/CNX7fegPeH3hid3Hc9ZEu5DkU6FPepU1VWv7fo0:sxvCLUJ
- MD5 SHA1 SHA512 SSDEEP