Analysis
- user interaction
yes - max time kernel
151s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 17:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cel.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
cel.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
32 signatures
150 seconds
General
- Target cel.exe
- Size 18.5MB
- Sample260717-wb8ecscy7v
- SHA256 fc755b86385fc5ade53370830218fd923e60b2da2f1947065a07f49ed3e8538e
- MD5 858d234c790f10e52d2d20772e9eeb25
- SHA1 00b0b3156007f125a8c66944df4086e89ba3b20d
- SHA512 2da6a8a6e32a8122054745369f0eb3696b338d6fcc531e4e6973620f8e993376553fab9a91b1bd50588d949092fb8adc7a79d916f20c45af5a0e2b05d092de33
- SSDEEP 393216:ToS/mof8P6WY/3232fcPOIVtMM2cIGzYRxTAuE8KHoj:ToSuof8tY/ObVtMB5GzuTi8I
- TLSH T17A17332CF9E244E9DE53E4BC8EA154C2EA327D514F21EB9752A5B4362F734E0CA32714
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 25 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\NonAutoResolve reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVVMCreators reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\HyperVFirewallPolicy reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\NonAutoResolve reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\TenantRestrictions reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVFirewallPolicy reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging reg.exe - Modifies security service 2 TTPs 7 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Active Setup\Installed Components reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} reg.exe - Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Virtual Port Monitor\Ports reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Virtual Port Monitor reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon reg.exe - Manipulates Digital Signatures 1 TTPs 25 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\trust\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\trust reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\trust\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\trust reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedPublisher reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\trust\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\trust\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\trust\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedPeople reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Policies\Microsoft\SystemCertificates\trust\CRLs reg.exe - Boot or Logon Autostart Execution: Print Processors 1 TTPs 2 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\winprint reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors reg.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Impair Defenses: Safe Mode Boot 1 TTPs 7 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend reg.exe - Loads dropped DLL 54 IoCs
pid Process 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe 1672 cel.exe - Modifies system executable filetype association 2 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\lnkfile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\lnkfile\shellex reg.exe - Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe Key queried \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe Key enumerated \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum reg.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\coreglobconfig.dll cmd.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI cel.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT cel.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI cel.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT cel.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3688 cmd.exe 5816 cmd.exe 5596 cmd.exe 4956 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language reg.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 cel.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters\Storport reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 reg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport reg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags cel.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW reg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties reg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters\Storport reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 reg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters reg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 reg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 reg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 cel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties reg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM reg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags cel.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters cel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW reg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties reg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport reg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters\Storport reg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 reg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters cel.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3952 vssadmin.exe - Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" cel.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Download reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Help_Menu_URLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\15 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\20 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\21 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\23 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\24 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\30 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\11 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\25 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-excel reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Security reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Settings reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\28 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\6 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\7 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-powerpoint reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-word reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\ee6c26b7_0 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Document Windows reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\36 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\LowRegistry reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\excel reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\word reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\13 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\17 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\18 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\3 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\37 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\d99f01ab_0 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\PageSetup reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\33 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\SQM reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\IntelliForms reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\10 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\19 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\26 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\27 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Suggested Sites reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Toolbar reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\VersionManager reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Desktop reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\12 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\5 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\powerpoint reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Zoom reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\GPU reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\IETld\LowMic reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts\34 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\International\Scripts reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\InternetRegistry reg.exe - Modifies data under HKEY_USERS 26 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0173-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0156-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0294-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0357-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0128-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0308-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0245-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0065-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\HAM\AUI\Global.IrisService\V1 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0220-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0263-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0215-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.ECApp_10.0.26100.1150_neutral__8wekyb3d8bbwe\ActivatableClassId\App reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0084-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0253-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0048-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0092-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0078-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\Interface\{0f872661-c863-47a4-863f-c065c182858a}\TypeLib reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0199-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0047-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0021-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0051-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0065-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0089-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0007-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0037-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0123-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0383-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\lnkfile\shellex reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0211-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0087-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0072-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0185-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0174-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0212-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0096-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0116-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0159-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0191-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0360-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0093-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0240-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0313-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0174-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0175-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0108-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0153-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0343-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0167-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0073-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0112-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0049-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0191-ABCDEFFEDCBA} reg.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 548 reg.exe 1756 reg.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 2508 Process not Found 4808 Process not Found 4968 Process not Found 2056 Process not Found 5064 Process not Found 1692 Process not Found 2836 Process not Found 4864 Process not Found 5940 Process not Found 3212 Process not Found 3572 Process not Found 5604 Process not Found 5628 Process not Found 5588 Process not Found 5396 Process not Found 4240 Process not Found 2616 Process not Found 1892 Process not Found 5412 Process not Found 1492 Process not Found 3428 Process not Found 1836 Process not Found 4708 Process not Found 3364 Process not Found 2692 Process not Found 4416 Process not Found 2520 Process not Found 3584 Process not Found 4876 Process not Found 4996 Process not Found 3232 Process not Found 1352 Process not Found 2260 Process not Found 3760 Process not Found 3684 Process not Found 2960 Process not Found 2192 Process not Found 5012 Process not Found 4616 Process not Found 5736 Process not Found 4844 Process not Found 1684 Process not Found 3356 Process not Found 2424 Process not Found 6096 Process not Found 2504 Process not Found 3568 Process not Found 5620 Process not Found 4740 Process not Found 4268 Process not Found 5108 Process not Found 5388 Process not Found 2368 Process not Found 4832 Process not Found 2672 Process not Found 3468 Process not Found 1304 Process not Found 1320 Process not Found 4116 Process not Found 4212 Process not Found 2364 Process not Found 3176 Process not Found 2408 Process not Found 2608 Process not Found - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1748 shutdown.exe Token: SeRemoteShutdownPrivilege 1748 shutdown.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1672 cel.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1940 wrote to memory of 1672 1940 cel.exe 88 PID 1672 wrote to memory of 4216 1672 cel.exe 90 PID 1672 wrote to memory of 5760 1672 cel.exe 91 PID 1672 wrote to memory of 5924 1672 cel.exe 92 PID 1672 wrote to memory of 2000 1672 cel.exe 93 PID 1672 wrote to memory of 3500 1672 cel.exe 94 PID 1672 wrote to memory of 4668 1672 cel.exe 95 PID 1672 wrote to memory of 4064 1672 cel.exe 96 PID 1672 wrote to memory of 3688 1672 cel.exe 97 PID 3688 wrote to memory of 548 3688 cmd.exe 98 PID 1672 wrote to memory of 5816 1672 cel.exe 101 PID 5816 wrote to memory of 1756 5816 cmd.exe 102 PID 1672 wrote to memory of 5596 1672 cel.exe 103 PID 5596 wrote to memory of 3952 5596 cmd.exe 778 PID 1672 wrote to memory of 4956 1672 cel.exe 105 PID 4956 wrote to memory of 1748 4956 cmd.exe 1050 - outlook_office_path 1 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cel.exe"C:\Users\Admin\AppData\Local\Temp\cel.exe"1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer Protected Mode
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\cel.exeC:\Users\Admin\AppData\Local\Temp\cel.exe2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /f /s /q C:\Windows\System32\*.* 2>nul3⤵
- Drops file in System32 directory
PID:4216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /f /s /q C:\Users\*\Desktop\*.* 2>nul3⤵PID:5760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /f /s /q C:\Users\*\Documents\*.* 2>nul3⤵PID:5924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /f /s /q C:\Users\*\Downloads\*.* 2>nul3⤵PID:2000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /f /s /q C:\Users\*\Pictures\*.* 2>nul3⤵PID:3500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /f /s /q C:\Users\*\Videos\*.* 2>nul3⤵PID:4668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /f /s /q C:\Users\*\Music\*.* 2>nul3⤵PID:4064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKLM\SYSTEM /f 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM /f4⤵
- Modifies firewall policy service
- Modifies security service
- Boot or Logon Autostart Execution: Port Monitors
- Boot or Logon Autostart Execution: Print Processors
- Impair Defenses: Safe Mode Boot
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies registry key
PID:548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKCU\SOFTWARE /f 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\system32\reg.exereg delete HKCU\SOFTWARE /f4⤵
- Boot or Logon Autostart Execution: Active Setup
- Manipulates Digital Signatures
- Modifies system executable filetype association
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies registry key
- outlook_office_path
PID:1756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:3952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown /s /f /t 33⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\system32\shutdown.exeshutdown /s /f /t 34⤵
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a33055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
PID:3520
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:1968
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000003dc 000000b81⤵PID:3952
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000003d8 000000b81⤵PID:1748
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa2539055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
PID:5008
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
4Active Setup
1Port Monitors
1Print Processors
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Port Monitors
1Print Processors
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Direct Volume Access
1Impair Defenses
2Disable or Modify System Firewall
1Safe Mode Boot
1Indicator Removal
3File Deletion
3Modify Registry
8Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\SDL2.dll
- Size 2.4MB
- SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
- MD5 83c5ff24eae3b9038d74ad91dc884e32
- SHA1 81bf9f8109d73604768bf5310f1f70af62b72e43
- SHA512 38ff01891ad5093d0e4f222c5ab703a540514271bf3b94fb65f910193262af722adb9d4f4d2bd6a54c090a7d631d8c98497b7d78bd21359fdea756ff3ac63689
- SSDEEP 49152:7Vj3jF2sAlo/43FCPLQ+Ebh8NsB+f94OKLvci5R77CuiY:RrjFiOmC/65TowxCui
- TLSH T1B9C52A0AB3F6179CF6F78E749676A7225832FC298910DAAE2150953D0C31F908975F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\SDL2_ttf.dll
- Size 1.5MB
- SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
- MD5 f187dfdccc102436e27704dc572a2c16
- SHA1 be4d499e66b8c4eb92480e4f520ccd8eaaa39b04
- SHA512 75002d96153dfd2bfdd6291f842fb553695ef3997012dae0b9a537c95c3f3a83b844a8d1162faefcddf9e1807f3db23b1a10c2789c95dd5f6fad2286bae91afb
- SSDEEP 24576:jS8/9uHym3+c6zXD75JqzkiTPxk6saGjhn7+DNvY1vDe9tnYP05pi8ZpFUcjt:n/9ub3+c6zXDrqzkZ1vjhiDNvY98W2UQ
- TLSH T157756C96E2A394FCC22FC170429BD773F531B82000256DBF99A4DE70AE11ED06B5DB69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\base.pyd
- Size 30KB
- SHA256 59fd2c87c8261f8de69fb70f881b41a13e522119503ae18fc068d607b4754bfe
- MD5 8d8f32f1ef4888aaece0c85c191e1396
- SHA1 d5af9f502bdf2b9e8d1688fd3a1436deca637147
- SHA512 c823fbda8f99f36082fcfdb945b3622de2f1329f9159c9d1bd2926109b2e6d964f41ebb97b1fd2637199f6e69ea7e7d43f16eae8d06eb878df260721b935a706
- SSDEEP 768:UTjWlqjQqVF1fvqHdHskDNxb3kqHMT3oO905:UWlqjnq9HzK7oOM
- TLSH T12BE21949276200A6E7A1517AC4736E1AC5F2B2610753D3CF43B4C7671F27AC9B63E742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\bufferproxy.pyd
- Size 18KB
- SHA256 7b1de4a711ac3b8c870a70d1b5db3a3684efd5ab258c4e1c42e715bd6e0a500c
- MD5 4fc8b58f80ee2c488aed3ecc89b14f04
- SHA1 8b79ab0a33e49a52879dfd9a5c317e7121699d08
- SHA512 91e358b391f9169db82aba90b79569e1c694b79a7f28c4efb200792027a2d59a1c89e745e928dc0fa9e60292cfaeb8c34e1421dc5a1eb2984890d79f34e2dbd9
- SSDEEP 384:L//kA88qNruCfhLCep5FzqNUMcODYTWOcMv:L/mLddmJ9s9
- TLSH T1CD821A0E7B909DEAD1664635C8635E47D2B1F26A075193CF0374D79A2F636832A3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\color.pyd
- Size 35KB
- SHA256 f1532048d8d89e0aff5a79f0dd96edaf7e75665c0292032c2b69a90374b4582a
- MD5 93e2c444ecb27a15eea288660f62efa2
- SHA1 a47c5dbca31e4c540c8b4e061c145a791dc42e60
- SHA512 d659d38bc01d4d4dda86a2df110d21bae873fe621a4755d1c0e6da996f62698ba3e873356097436a75ff00aa7067a30479f7501336ba9d915f70c39d727e8e5b
- SSDEEP 384:pZWoMXgPhMjJ6BlGK+MSsmnHVFm52qWq3ttvfb4tJyh+oais8zU1k8PsB8p+VMmc:bzPbcxQmK5bn+oais8zRsc8ptDSaN
- TLSH T18FF22B1963A101E6D7E78278C973790AD9A17131071283CF47F0CA6A5F23BD67B7B642
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\constants.pyd
- Size 49KB
- SHA256 99ef70bf473e1241a433f33dc7ec89dff64c831999de68612f2e642fd4a1d5dd
- MD5 c99a38e2ba2cb3403c346517d9ae10b0
- SHA1 7104921f4eaa6161533280db7325ff41d9fb9a7b
- SHA512 fb03ceafe79ba973be1ea060182db4a1fc54ee6c6bffd6ffe6250c6c7569aa059bb00b88b2b579303756df164a9b71a5b618c197c4fa837f4f491d467f714c95
- SSDEEP 1536:ZySNT4lbGDYTehOWBRQoKxGhJc7taN3n:ZabwPwaeEhJc7sN3n
- TLSH T1E333A3BCE38929F5CF29A0BCC2316627D17B70992990716F5561E365CF3F0236E90B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\display.pyd
- Size 44KB
- SHA256 6ce7e1f477c4aa614b1231b1a2ce345662bb36ed590157d48e219219f7459970
- MD5 fc08f56d212884440dd6531b5e6d38a9
- SHA1 ec8a4194c1a83d36dcd120aae7df3238bd2e0bbb
- SHA512 e87fc42bc228b2baf06c03e11227ed93d6e004f4827163098a5c176096ff02668d8efa85069ab702d026e3c382c1f1e6d036c727eaa377365430605bacdadcdf
- SSDEEP 768:xwSyBaybrqO3VtjC45sv5RqBlOqTQ4RtxqJMTv5xSfxp6XbE:Oa8qejC0iWOoRtMMzMmXg
- TLSH T1AF135BA5366240EADFB1857488372F2BD2B1B0121B4167CF2664C29D5FA37E3F23DA45
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\event.pyd
- Size 43KB
- SHA256 b9a3dabaa705c50d3d78505195eb609e7883c01ec080db2f21e7251025b3309c
- MD5 716c398729334612c9f1a06758c704e7
- SHA1 85b26ae869d787a5cd21041e38a9d03e763fef0c
- SHA512 77b52d8bb86c1ebd50030595fdbd1c27011a5b113835045186699d0ca3c65b4bfd21caf643bfd96a1a607805d5e6aeefb357da18732401e4573a1421e27b7ad3
- SSDEEP 768:/PZ3fDO3ACvjah3KZXXA8iRcRj1nzIcLaaULLm0y1Wo:/FfKQCvjfmcRh8ct0qH
- TLSH T17C132B5762AC80BAD97A817DC9332A1FC5B371629B5097CF02B9C5CA3F529C311BFA05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\font.pyd
- Size 24KB
- SHA256 413c4e8f918cb654dcd5788c5717142eb42af9ba1b07bc2ae94d1cb856783090
- MD5 649e18d027b0eaee79b48bb8bfe2c9b7
- SHA1 d1e57aa2f596a549c4cf2d9bab1b62db674ebbc4
- SHA512 37ca3855871a934f2d93de2c40bb07cb3eb0b13e0c34eb722fcf303e38af0c79f0a92d66224199ed8057fb713fd04bd8238a59c04b2e3fc546a13f97881bd7ce
- SSDEEP 384:l2nitb7KATIvRQkL/QKDe4Aif4FROYZjqlTrkk4gFBbobQoE2u6RfcMcBi8:3nmzDe4krSlToTFlHcBi8
- TLSH T16DB209497B5464FBC5AA8438CC23AE4BC1A8F6651B12E28F46B187DF1E663D3923C741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\image.pyd
- Size 29KB
- SHA256 a6100714b22ceb504bc5a303f86ac28ceb1ac47796175f101e23e869eba4480c
- MD5 0622e5584c056ee70f1e7df00a725825
- SHA1 28bf85d58d710d881404b9c1c903e978f66c1b1d
- SHA512 0c601ff23d564d011432445445295e0a089bb7160e9eef89e3e24f2b9272d8bec5c8256a08242055b0db92d0ae162f08e7ba1e552b43176dec928c194332601a
- SSDEEP 384:FmlOjs9hcrs3DbGv6E9WEZk1jnzy91tgw9UuqOHwIrfoqrJyEchD5nsScNo:cvus3DbElQWK84GG9e
- TLSH T158D23BC1BB6660DAD17355748913DA46E1B1B7A30A0087EF83F088BB1F36D92B739746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\joystick.pyd
- Size 20KB
- SHA256 cf5c43e5dbe986dfadf17e9fa6583ba0932540f31d359024abfc69bcc2cb6f8c
- MD5 31b1f42c2e0d869deddf16d61c3a69cd
- SHA1 c1ce187f89a1f3ab0a25d171265c6ad49a2e27f7
- SHA512 2416bf9e308a59eb40f07bc88d4c0fd3836ad2223922deeea8226fa41dfac48d517fd5788b20c2b886c401ba1eb421118d3266a4ab652b855f1e7619a9302f36
- SSDEEP 384:5Wu9gLRfI9gJbE5RMHvvhZCwkiZiMw/y1R5cMxA6ToXD:5Wrfkgc+nnCwkiDN1BO6To
- TLSH T12A92294EA742D5BBDD65803CC8775E1692B5F02313134ADF06788B5E0F9B7C262BAB80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\key.pyd
- Size 20KB
- SHA256 ce4815ce82bef66100d83b3244a5a0db2ec62a342d80b03e3e560d6aa5d7c583
- MD5 09fb1a972812645b3bf92497db4249bd
- SHA1 556927de27b2123e0affadfc8da8c1e228bfb9cd
- SHA512 6ae0803343d3346e2509eb8a618f5e317e4861a7ec0d1c56fff8636ec8788c762c86709040018113c0fd5aa1ec95d5020373632403867b9e67d9a6af4b1353fd
- SSDEEP 384:hdcyQUolQ6Byy2O3r6a5MvhA8Zsbc7XnDUm8cM:fcXdKZsA7XnYH
- TLSH T1D19208A6A79251E7DAF1C174C4AB5E06D426F1331B13638F4B64858E0E327A66F3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\libpng16-16.dll
- Size 206KB
- SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
- MD5 3a26cd3f92436747d2285dcef1fae67f
- SHA1 e3d1403be06beb32fc8dc7e8a58c31e18b586a70
- SHA512 73d651f063246723807d837811ead30e3faca8cb0581603f264c28fea1b2bdb6d874a73c1288c7770e95463786d6945b065d4ca1cf553e08220aea4e78a6f37f
- SSDEEP 3072:VatMOImapxER0/vnm2mjq61IJJT1fX0yuWUQstxZw2TnzFEY5IQ:VatMOImapaR03nmnYJV1cjtnwunw
- TLSH T194246C47F3A35DBDCA97C1748257E772A671BC242234EEBF1294DB302E11C60771AA29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\math.pyd
- Size 75KB
- SHA256 515e2cf7344b6daedd464f567ca99978a47da14719b7f5a092c69a252b16c5f3
- MD5 1b22c99f786127fce7bdad124e3c7c75
- SHA1 7176206194cb03f43085ef035d97c1defb897ac0
- SHA512 418698c3cfad05266dac353eceed92c218bd1deada28f0b60b69f649262e0e77a1fc26c11621e0d56039a2004db8fd58344125b166cc0d4acf550d4f53d53e58
- SSDEEP 1536:sgB5O/MxqZ7T7KVbg4CLjUJaqKqABnNMrXzt:XG4qZ7Tobg4WjULKqwn2r
- TLSH T136731810665550E9DC236078C82BAE93E3A1F0E28B1297CF16E9C65D1E87BD11F7FB42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\rect.pyd
- Size 44KB
- SHA256 38d709cb73a98dd54d666689212bfdddc2a68fcc4541c3b59a741815e4688b7c
- MD5 5e470f74a24a7832f7f9bb8bfb60bab3
- SHA1 fbc2bb77925b46f3e2967e4ca5f0432fd54b1832
- SHA512 4cac9b51ae9f8e030326c25203acad80f52ec7416f0ae22dd31bf988854b53627a770ecc07e14dfeebd8d4d49536210e27f7b8dfafaf8250038dc9379da9178c
- SSDEEP 768:gKROcGJd4pGBzFU/T6yh1PtF63Fc7DYenlnoirvT/ypgm7dyun:pOcGIpG3cmyjPtHnoiTT/CbRFn
- TLSH T12A131A46619140EAC9B2A179C83B2E63D6E1F011271293CF12B4C78E9F57BE3567EF42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\rwobject.pyd
- Size 19KB
- SHA256 b658da9b9b207f73325b9e9b84029258e64e324b8935671ce79b49f28a26b87e
- MD5 8a8e613bcc4eb8fafc1af01a33eb8a5c
- SHA1 7a408b1ed0c3d7b38594fc721c7f0a2e1aceffa2
- SHA512 c24eb11c6f52aa03a4f4e83edda0f6a26246f6ab5176b6a1c205ead64e0656510db66cea715e302520404b1f8577f1687656db39c5c2bff044beee194a581735
- SSDEEP 384:mNzwmtWoVqgK1ap0TZt3P2JYrwToSooZNbxTVvt8eocNz:NCRkawUNbKKz
- TLSH T10F920B0AA69A15ABD693617CC8237A1BD1F171022313E7DF03B0C7A51F276D65A7D703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\surface.pyd
- Size 234KB
- SHA256 bc64469279ac571f08173b2a09da78f1c0af3276e531fdf12ec3f9e9eca8fdde
- MD5 3b265f392b9d19488b552e82eb8f4bff
- SHA1 4553c4af5be1e7235a25102c872dad406455c389
- SHA512 7f795f8439d07b45572740f1e1bcf6020e7edf5d3d32fb89d754291aacdac0f001ca63d02c5c05d3f73193c7fe3d10eabb870d1ca114d70121e657ace02b7258
- SSDEEP 3072:eIIImmkpkbkmk7mjmZmH4DX8+AwIMqTGNgHnWo6I6:eIIIXkpkbkmk7mjmZmH4DX8JMgHnW9
- TLSH T15B342A9975279AE3FC13027C8A6BE68061A4B5AA034EBFF7F4D150585B273F0383D952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\time.pyd
- Size 18KB
- SHA256 20025c990cc49ca1d58b84d0e3b9b84932a2ce98ae192d0415b7061369837d91
- MD5 97e7455f7d54efa1408bb198250eb13a
- SHA1 56eb2a9a20e0bfbadc3fce189cb0389ca56d125c
- SHA512 da9a3e0194bdf9b4410c8a8c7644acade3b8440a13c8c627bdb7ac72c67efc06d5ffe6cecbfb1fc6f0b6da5d969c25c18f297502c529b118afdf406885a07dd5
- SSDEEP 384:6INKEqeOGdrIRQGX5IaHfz9AsfMl59LpU2cMgM:TVqewHfzBMzJpzg
- TLSH T109821949B7A4A4E7C9B941B988736E06D270F252171143CF03B0CAAF5E277D6663E704
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RGIC4AE.tmp
- Size 24KB
- SHA256 7edd143fcf7979b14390a36b12bf79955bcd92a583a5c51f38d12f3f369c9849
- MD5 cf791e2df30e983daa9f7cf2a0f46daa
- SHA1 862012220be1f7e549954a80ebddfcfc0cf31d7b
- SHA512 c22ff335a5ba5ec1c1806ad53c5f1be6e82d352a0d6b606c4a185641a9eb565c187e99b4f16509936bb967f9046668ef18e889c3a31ad76aaf8294fd2e7f0470
- SSDEEP 192:D161V1+hcTueeCSh5e29gEK6WK2SpCSPQVsLIn8SYLzoDpjF/qTUqYjZ2l5gnJQT:D12+hcTueeCSXe29KSwIzw3VgYJQT
- TLSH T190B2C0295221F7ADB811367D10EF360181DF259AD74CFDD53EC86A507DE9E8380A23EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\VCRUNTIME140.dll
- Size 117KB
- SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
- MD5 862f820c3251e4ca6fc0ac00e4092239
- SHA1 ef96d84b253041b090c243594f90938e9a487a9a
- SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
- SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
- TLSH T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\_queue.pyd
- Size 32KB
- SHA256 37622ca591fb8e45a894db9c0da99bfcb18a820a48f028e4949d9256b69247e3
- MD5 6f8624f0746fa31cf72ef568d6a121f1
- SHA1 1054fb373ea2aa51cb04fe98e6efd130be34fc43
- SHA512 e52199265a0360027d21034060984dd2100b79faeb03b86cb7a6545da10c00d860117598f659ca38c5bddf368d2f525e4a337011cc78bbce5307baa52588fb9a
- SSDEEP 768:j1zRmezU6rGS17r4xI+QUtlJyUFRYT2Ip4ACxf1mlD0D8:9Rm01Gw7r4xI+QUtvyUzR9xfIID8
- TLSH T1ABE27DCBAA684047D563D670C2B2DE92F935B7D3160187DF206AC18D2F277C2A72971E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\cel.dll
- Size 20.0MB
- SHA256 99b71832e8ee2a543f488e79cb81e1421201625866e8778b1c8fa77dee9770a2
- MD5 e63b6f8fb44dcad68383577f96601061
- SHA1 188af343ade8ac73c0b11909deca89d81ac456cf
- SHA512 3fcf140fee19ae789819922eb071e53f858bd61cf1472f65bd29a776dff8e77d2cdf3a7b5ebad0f9a3569c731f099ae87f6f99936bdfea348909a905452994ac
- SSDEEP 98304:MBe49M9qnSiUQOiv7H6cMBCQPNNRAM91wgc6fTESbZYV1Tj/Np8fD1pUVq17UpJ6:MBe45U/iv7H6Igc6fYIZK1nFwD17vl
- TLSH T143272A0226988062F9A2E7FD6C56528BEB71B427371367D7306EC44C7F439A656BF08C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\pygame\SDL2_image.dll
- Size 122KB
- SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
- MD5 b8d249a5e394b4e6a954c557af1b80e6
- SHA1 b03bb9d09447114a018110bfb91d56ef8d5ec3bb
- SHA512 2f2e248c3963711f1a9f5d8baea5b8527d1df1748cd7e33bf898a380ae748f7a65629438711ff9a5343e64762ec0b5dc478cdf19fbf7111dac9d11a8427e0007
- SSDEEP 3072:6bsejIuO504fzsOM05Nmy7iGpJ7SvFisgf:6bmX0qQOhmyPs
- TLSH T182C34A17F2E3A0FCC617D0B4A297B637F43138551630BEBE1BA09A345E61E207B9D916
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\pygame\draw.pyd
- Size 49KB
- SHA256 18e7ec3c61c272318b08adb7c5466c334abf6f75becc5824f5ab8fdc5f6e9a31
- MD5 24384353a25aae57a28366c4706f5a95
- SHA1 4974d5bbde919c4c1d4c2458d44c99375b4fafd5
- SHA512 f01a3d6e767324faff0a64a39f6358511375610b052e8ed53a0b7e91cc7f8984ca0546d2001d637269018945420fab0ac5e36604c1a561c2da15a4a72db0ce27
- SSDEEP 768:taaeYXUIuXK2GtWl7/IsrASETgDspoaNqCj/79uUrIscQgw7lz:taapXUfB4Wl7/IeETPjcF6z
- TLSH T131336B02F2C456E9C4B78874C976B81BE7A07419571A43AF9B60E90D1F327D36B2FB06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\pygame\imageext.pyd
- Size 17KB
- SHA256 7ff15e58ae5f0de963508bf002d99363b7e9594a09beabdd99f5d9fb1edce0e3
- MD5 b1bb55cf83b2b2562813e46bb7a9f635
- SHA1 513022947d3fcb083edb3e2e00f1615bd66b0bdc
- SHA512 509cc2bd8aa8fd254b908bcd05017c9bcba51d4b239bbd29ea57e30bafabdeaf2a32aff3dc5364e16de8ad3ab6753938c0af5f47a2d71b6b0dbb0284dbb51022
- SSDEEP 384:cLvQt480HiCU/f1ei53ziTkWuin7ivcb6:S8EHi+QCn7D
- TLSH T163723B867740ACDBC959C17AC87B6D4AC6B1F2611641D38F03B1C92E6F37B476A2AF40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\pygame\mask.pyd
- Size 54KB
- SHA256 c506e7421bcc10b9d0b45ce44152c8fec242d310fd9fd9aff94d001e3893fa90
- MD5 679ce4fd166a54a5e48b7910e05413d0
- SHA1 ae13756e701b0759a773a2d77db327bf5d595441
- SHA512 994254ba08fe3e5eb88b27804f0d6c9da707deebbab173728f3ff62187c59ec9508545a1eaf9bd8aef7a59faa1c974b27a6ead26a6555a9064634a94565a556e
- SSDEEP 1536:eiOKiXUVH2BmAYt5M+BxlNZDa71TOY+YjQup2XjDEbHpgTZ4:eiOKiXUVH2BHYDlzlNwIWp2XjIbHpgTq
- TLSH T123435C4966D620E9D7A3863EC4771A07E5F1F86007129BEF43B4C26A2E53BD6933E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\pygame\mouse.pyd
- Size 19KB
- SHA256 d0609d148cfc8337ed87ac92fba3e226efaea2405cdf488b9cdea540d3f05881
- MD5 3858e2de3b12b33971d382f2cef8bd5b
- SHA1 02941759a580e5884f5b617a96aa9c7c598ae9eb
- SHA512 9ceb90b237d8b42eb3c4293e526223f0e39901a0e8aa00726043317da27f0d1109547e5a828927c89bc9e07d472275c1a97508825d21a747b2400b30877b7c95
- SSDEEP 384:WDvMpx1dNnMzM+aA57HHucPR0dcFlCtgDTi+cM8KU:WDMpx1rMzhucPWdcP3x8F
- TLSH T14C920999735195FBCA6482B4C8664E2BD070B2210722D3DF02B0955E6FA6BD3623FB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\pygame\pixelarray.pyd
- Size 47KB
- SHA256 99ac7eab08cb2ff078ea515ca51ba8c86819d47b8820d41cb65d645f0fafddc0
- MD5 0b078bf866105f0c2ec11ed949b60339
- SHA1 2716a8f31a04cd939300df78af0c505c96eaebcb
- SHA512 21f67d838f3233b894250c2ee66c7065c2fe674b84cefd3439332ae35aac693665158fc474f5b96b501d8e29929844e485917e8f63516a3f3a74355172045b49
- SSDEEP 768:3ZQvkUggkoUF+6ksTl+oDwaW+zHcICtnPqT/Hudafjw6Ub5HRNnPeX:p5lrwax7CPUjw6I5HfW
- TLSH T1E9235B46A1C591DAD8A6807CC87BBF13F9B0F161150297DF43E0C68A1F93BE2727A741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\pygame\pixelcopy.pyd
- Size 26KB
- SHA256 d430b7bab200bba63a8b4f74081cf409c9fb42dc3e4f2097cc77988b7f9fbb82
- MD5 4d06b14f0d4bef2cc95b806a29c460be
- SHA1 384a7e31a56a4425218f2d55089482fa1238709d
- SHA512 a0f1b5d9ec3f9e1f72c9f611bb119f80e28f81446b6075b8ae5b31cf2343bce95de4b1c009efb120d17b3e608fd7df65f1a874bf011ddf58b13c8f334173f513
- SSDEEP 384:mWXltDD8EQ6s4X4RzPgXsX5gJbPFkfVw9rXep4f/EMBnt82eDzlncMI:mWXltDDSL1+XsX5glPFaGntUHn
- TLSH T125C25B2B675110EED4638170C86356B3E8F5B6A0172043AB17B0FF927F67EF2A225B05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\pygame\surflock.pyd
- Size 13KB
- SHA256 6c0c944037dc7a23e4ca6683d58085752453faf3be1e776a0ebd33f3d0fda8d5
- MD5 8777b1f680df33a36e4f96ae4ab469e2
- SHA1 c48294807ba3b1763a874bc17147a8c6b32acbb7
- SHA512 222ddac8190c6c7b0341d29f2cbcf4e11abf819469076cc8bbee8b615cfdcb8603b5a1cd526e327aa75b596920dda12c7518c744fa60a476e093c1790503ade1
- SSDEEP 192:AeS1uoQjSpXF1eYn6BMfQLvJ69FHg9sU/ZMc2mU:AV1uoQjSpVuBMGvMFHgscM1
- TLSH T17352084DA76055EAC52B41B4CC234A06EAF6B11157926BCF0374A2D62E73BD6323F790
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\pygame\transform.pyd
- Size 57KB
- SHA256 e746b718c52de41492139a5152c842b0bfd8faaca4b992e8df562aa3c4ca97fd
- MD5 8c3b80c7d09ca7860ca3e13b4c9623fc
- SHA1 7f610b1825742b8715504ef074e990b599b6a319
- SHA512 ee3b08b2e4dd428e69f8ac4bd88b684512539f4b8ccd4e5765a3baf04f29c8529cc2cb566998babff8f36a823fd927b842737443f4ef59e703a8fd7c7043bd37
- SSDEEP 1536:451hVx1dyD3aowQVqYbOnrFPcCQjyBI5mnTondSQdpZ:49f1GKow6q7o4I5mnTZQdp
- TLSH T118436D86D36721E9D4B7417156770917FAE0B6290310D38F82E0C6262F7BBE9B5BE341
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\pygame\zlib1.dll
- Size 106KB
- SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
- MD5 5eac41b641e813f2a887c25e7c87a02e
- SHA1 ec3f6cf88711ef8cfb3cc439cb75471a2bb9e1b5
- SHA512 cad34a495f1d67c4d79ed88c5c52cf9f2d724a1748ee92518b8ece4e8f2fe1d443dfe93fb9dba8959c0e44c7973af41eb1471507ab8a5b1200a25d75287d5de5
- SSDEEP 3072:wLmjK8n5MYk+NqZSB23eRenGvTBfs9Yy0J:wLl8n5MYCjFnaTBwYy0
- TLSH T16FB38E9BBA9362FDD972C17052E69BB4E930BC0109705ADB5148FBB02F12C906F597EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_1940_134287839724080787\python312.dll
- Size 6.6MB
- SHA256 3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
- MD5 f9a43765b486c561bf0895eb9390ed1f
- SHA1 b398fbd02bd7fdb32dcb88f11758a0a9826b75a4
- SHA512 f2709ba81fe1e01789fc0aae65d31f5adcfd64dd72d161b4cddfa35f91eb2c8d66954925c825b22ce9034fd894ee18500b1ff0a32e4d585491e09d2c540a305c
- SSDEEP 98304:8HdLykRHSHAtre59efJBVvTHqMiEnrZpd50:8HdLykRXg9Y5iEZpdu
- TLSH T11A667C567358C0A9C97BA0B0CC13C68EE7B27C517F50930B70AAB75E2F73792969A344
- MD5 SHA1 SHA512 SSDEEP TLSH