top of page
Using DCOM objects for remote command execution | Securelist
C45-2025-12-19-7
Indicators of Compromise (IOC) List
Indicator of Compromise (IOC) | Date Published | IOC Type |
|---|---|---|
127.0.0.1 | 19/12/2025 | IPv4 |
ed1f9e435dc885292eab65620c51f3fb | 19/12/2025 | MD5 |
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
These locations are important when Control Panel DLLs need to be available to the current logged-in user or to all users on the machine. However | 19/12/2025 | Win_Registry |
HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
Although commonly known best practices and research papers regarding Windows security advise monitoring only the first subkey | 19/12/2025 | Win_Registry |
HKEY_CLASSES_ROOT\AppID. Several subkeys may exist under this GUID. Two critical ones are | 19/12/2025 | Win_Registry |
HKEY_CLASSES_ROOT\CLSID | 19/12/2025 | Win_Registry |
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
For 32-bit DLLs | 19/12/2025 | Win_Registry |
HKEY_CLASSES_ROOT\CLSID key.
Check whether they support any known valuable interfaces. If they do | 19/12/2025 | Win_Registry |
HKEY_CLASSES_ROOT\Interface | 19/12/2025 | Win_Registry |
HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
Under | 19/12/2025 | Win_Registry |
HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls and then created a simple C | 19/12/2025 | Win_Registry |
bottom of page