raccoon | hxxps://adainstaller[.]com/aofiler/hjksdgfd4657i687iyouhkjgfrctxy5uerytukj-pesktop[.]php

Analysis

max time kernel
127s
max time network
445s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2023 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://adainstaller.com/aofiler/hjksdgfd4657i687iyouhkjgfrctxy5uerytukj-pesktop.php

Score

10^/10

raccoon 13718a923845c0cdab8ce45c585b8d63 stealer

Malware Config

Extracted

Family

raccoon

Botnet

13718a923845c0cdab8ce45c585b8d63

http://94.142.138.175/

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Executes dropped EXE 1 IoCs

Processes:

Satups.exe

pid process

4884 Satups.exe

pid	process
4884	Satups.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "698521232"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051d6db365ce0f843a8e6cfaf226c4d2b00000000020000000000106600000001000020000000bfaa4e65c0bc5a909c91e6700f843416a38d8ba4a2efc29e9c4b94665efadbc7000000000e8000000002000020000000c12e4d76570b5934ab6c6281bc5fe47d60a5f7aa9fb73588f1751a71d610f92e200000001974830b6c1619ad872925f1b95a947b4536618e5ef65e1820145506285c68ea400000003da1fd6c49a8c4bd62b1db7891a3cab20813e5ca3efd2616b50b4a5b926b951b4767bcded3da8974e7bc3325f46adacf2d31549ee82bdd971c27a7c96f69c851	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{549DFA16-E53F-11ED-8227-CEBAE7FD2CA5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31029580"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "710580929"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31029580"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e68d2d4c79d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002d9b2d4c79d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "698521232"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31029580"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051d6db365ce0f843a8e6cfaf226c4d2b0000000002000000000010660000000100002000000025628642c036427b38474054dc6bf178425697c7420adc335b0b43ef8577bd59000000000e80000000020000200000000ed6d1017945c9002eca7e2f07d7d8dd9065867f38213bcf9f3341d008f4594220000000c88a66fac4e3793a8cecb61b7521f17b7f51fdbb222ec311f780e04db9940a3a40000000872063cdbb4a8c259476ca2f3744ec47bb22a930d56420044dea01bcc1673b70b33b94ea5a65464ee60e3e6e709b6ffd69451561d8dc6a75d5ec260a81c25492	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe

Modifies registry class 64 IoCs

Processes:

OpenWith.exefirefox.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000555602191000372d5a6970003c0009000400efbe55560219555602192e000000d7e7010000000d000000000000000000000000000000db36fb0037002d005a0069007000000014000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c003100000000009b56d4a8110050524f4752417e310000740009000400efbe874fdb499b56d4a82e0000003f0000000000010000000000000000004a00000000006ee50d01500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Applications	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Applications\7zFM.exe\shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe

NTFS ADS 3 IoCs

Processes:

firefox.exe7zFM.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zOC59110F7\Detail.png:Zone.Identifier	7zFM.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zOC59FD5D7\Satups.exe:Zone.Identifier	7zFM.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

5816 NOTEPAD.EXE

pid	process
5816	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

taskmgr.exeSatups.exe

pid	process
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
4884	Satups.exe
4884	Satups.exe
4884	Satups.exe
4884	Satups.exe
5360	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exe7zFM.exe

pid process

4296 OpenWith.exe
2396 7zFM.exe

pid	process
4296	OpenWith.exe
2396	7zFM.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

firefox.exe7zFM.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	772	firefox.exe
Token: SeDebugPrivilege	772	firefox.exe
Token: SeDebugPrivilege	772	firefox.exe
Token: SeRestorePrivilege	2396	7zFM.exe
Token: 35	2396	7zFM.exe
Token: SeSecurityPrivilege	2396	7zFM.exe
Token: SeSecurityPrivilege	2396	7zFM.exe
Token: SeSecurityPrivilege	2396	7zFM.exe
Token: SeDebugPrivilege	5360	taskmgr.exe
Token: SeSystemProfilePrivilege	5360	taskmgr.exe
Token: SeCreateGlobalPrivilege	5360	taskmgr.exe

Suspicious use of FindShellTrayWindow 31 IoCs

Processes:

iexplore.exefirefox.exe7zFM.exetaskmgr.exe

pid	process
1288	iexplore.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
2396	7zFM.exe
2396	7zFM.exe
2396	7zFM.exe
2396	7zFM.exe
2396	7zFM.exe
2396	7zFM.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe

Suspicious use of SendNotifyMessage 23 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
772	firefox.exe
772	firefox.exe
772	firefox.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe

Suspicious use of SetWindowsHookEx 31 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exeOpenWith.exe

pid	process
1288	iexplore.exe
1288	iexplore.exe
804	IEXPLORE.EXE
804	IEXPLORE.EXE
804	IEXPLORE.EXE
804	IEXPLORE.EXE
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe
4296	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 1288 wrote to memory of 804	1288	iexplore.exe	IEXPLORE.EXE
PID 1288 wrote to memory of 804	1288	iexplore.exe	IEXPLORE.EXE
PID 1288 wrote to memory of 804	1288	iexplore.exe	IEXPLORE.EXE
PID 4972 wrote to memory of 772	4972	firefox.exe	firefox.exe
PID 4972 wrote to memory of 772	4972	firefox.exe	firefox.exe
PID 4972 wrote to memory of 772	4972	firefox.exe	firefox.exe
PID 4972 wrote to memory of 772	4972	firefox.exe	firefox.exe
PID 4972 wrote to memory of 772	4972	firefox.exe	firefox.exe
PID 4972 wrote to memory of 772	4972	firefox.exe	firefox.exe
PID 4972 wrote to memory of 772	4972	firefox.exe	firefox.exe
PID 4972 wrote to memory of 772	4972	firefox.exe	firefox.exe
PID 4972 wrote to memory of 772	4972	firefox.exe	firefox.exe
PID 4972 wrote to memory of 772	4972	firefox.exe	firefox.exe
PID 4972 wrote to memory of 772	4972	firefox.exe	firefox.exe
PID 772 wrote to memory of 4092	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 4092	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe
PID 772 wrote to memory of 824	772	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://adainstaller.com/aofiler/hjksdgfd4657i687iyouhkjgfrctxy5uerytukj-pesktop.php
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:804

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.0.857328557\1237318306" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04c493d7-3b81-4f3c-b56f-594bbeb35237} 772 "\\.\pipe\gecko-crash-server-pipe.772" 1932 27d8f816858 gpu
3⤵
PID:4092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.1.1772355426\433158413" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3866e068-84b8-48b5-a472-f66ad96b67e8} 772 "\\.\pipe\gecko-crash-server-pipe.772" 2332 27d81871658 socket
3⤵
PID:824

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.2.538830329\2134674427" -childID 1 -isForBrowser -prefsHandle 3172 -prefMapHandle 3296 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {303c7411-8b0b-4555-a517-5cf8ec3eaccd} 772 "\\.\pipe\gecko-crash-server-pipe.772" 2992 27d92433858 tab
3⤵
PID:1936

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.3.576705832\498518405" -childID 2 -isForBrowser -prefsHandle 2364 -prefMapHandle 1496 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bce88a7-26b9-4511-a2a5-dd7f46bd7e0d} 772 "\\.\pipe\gecko-crash-server-pipe.772" 1256 27d92a1ab58 tab
3⤵
PID:1560

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.4.184268570\1322511324" -childID 3 -isForBrowser -prefsHandle 4116 -prefMapHandle 4104 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65aaf5c8-a69a-499c-bb4b-a32d6c9e19b1} 772 "\\.\pipe\gecko-crash-server-pipe.772" 4128 27d8185b258 tab
3⤵
PID:1312

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.5.1061491931\1933228099" -childID 4 -isForBrowser -prefsHandle 5032 -prefMapHandle 5072 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ce1ff2f-0725-4782-b21d-4b439514486c} 772 "\\.\pipe\gecko-crash-server-pipe.772" 5088 27d81830558 tab
3⤵
PID:3428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.7.685472068\29729581" -childID 6 -isForBrowser -prefsHandle 5408 -prefMapHandle 5412 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {940cfbbf-26dd-44e1-be51-54c861690151} 772 "\\.\pipe\gecko-crash-server-pipe.772" 5400 27d9505ae58 tab
3⤵
PID:4360

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.6.1955360201\570462265" -childID 5 -isForBrowser -prefsHandle 5216 -prefMapHandle 5220 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe53173f-202c-459b-8c6c-adb68cbb2136} 772 "\\.\pipe\gecko-crash-server-pipe.772" 5208 27d95057558 tab
3⤵
PID:3964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.8.1364385692\456986945" -childID 7 -isForBrowser -prefsHandle 5880 -prefMapHandle 5844 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd5c3b12-4ed8-4f3f-a4b3-596c01b300f7} 772 "\\.\pipe\gecko-crash-server-pipe.772" 5872 27d9655b958 tab
3⤵
PID:5664

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.9.1766472565\334559602" -childID 8 -isForBrowser -prefsHandle 5484 -prefMapHandle 5388 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c255807-5fa4-4036-871c-02f408753a8f} 772 "\\.\pipe\gecko-crash-server-pipe.772" 3648 27d92a18a58 tab
3⤵
PID:5424

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.10.1660085137\1833807508" -childID 9 -isForBrowser -prefsHandle 5556 -prefMapHandle 5552 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a4b9a52-800b-40bf-a607-493ebbb51039} 772 "\\.\pipe\gecko-crash-server-pipe.772" 5544 27d94ba0558 tab
3⤵
PID:5432

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="772.11.437236224\1081193497" -childID 10 -isForBrowser -prefsHandle 5376 -prefMapHandle 5360 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {151d7990-a2f5-4e03-b1e2-0ce781156496} 772 "\\.\pipe\gecko-crash-server-pipe.772" 5292 27d94cec058 tab
3⤵
PID:5440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4296

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49.rar"
2⤵
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2396

C:\Users\Admin\AppData\Local\Temp\7zOC59FD5D7\Satups.exe
"C:\Users\Admin\AppData\Local\Temp\7zOC59FD5D7\Satups.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4884

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOC597A6E8\Keygens.txt
3⤵
- Opens file in notepad (likely ransom note)
PID:5816

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\" -ad -an -ai#7zMap26215:116:7zEvent32514
3⤵
PID:4556

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\" -ad -an -ai#7zMap12583:116:7zEvent5311
3⤵
PID:4988

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5580

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\" -an -ai#7zMap19553:144:7zEvent2834
1⤵
PID:4776

C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe
"C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe"
1⤵
PID:6064

C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe
"C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe"
1⤵
PID:1084

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:3188

C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe
"C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe"
1⤵
PID:1008

C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe
"C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe"
1⤵
PID:5412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
32cfc4ad06ca555eb9e4bd614c2e9f7d

SHA1
d143f88ee62c4fb5c722bae6dfa82020dd26fb7a

SHA256
1a38540597c76bb94f92842ee175f53aa04eeedaae3c3f288b925c491a0d2102

SHA512
88b12006025e189b0f7ceb9afdcac10857356705fe46fdbeb1675facfc2a6829269bf173df48b31d229d687ba9c94bd9eb4891bf5e871633297cd2d3649455fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
bb0fe6885e91cf17d023a94c9ffe8d02

SHA1
08ffb64c7b6ce5b6822c57e96cba4adae723eb03

SHA256
091494356a51f837a13bb44976c19ded2b9b3e8161c2c3c4ddaeb5133d5875a0

SHA512
5f22d0501c26869b50f37dbb46b30991829a452254da805b90bc384aead8cad20a68e60676159254c99f8059f7e81d0303c4806e8f223cfa19ea66ba29a8d858

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\cz9baam\imagestore.dat
Filesize
3KB

MD5
38b1281500db6ed6fff40173d214f8b8

SHA1
8d5a716272afa0a33dec85c9e1bad3ab598e813b

SHA256
9a61c0be3d1341b38274c1c24015c07d1fbda4a50a81d74d0640d3b89bf9dcee

SHA512
d9a8add8562a732b58df22ad95553afd21ab1a21842fb55954630edde7f5f8087f9e0b44055acaf46b49b97fbd4a8856bd17bbb07752a936d0a99f2d8bc6acbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
28KB

MD5
c69548309dc9db5cb3982cdd67361809

SHA1
b2ad2b0753eff8a7d487d7acd8aff5b8aefcbf98

SHA256
e1b07cfa09e78ab9a2c1a9e8ad23bbc0b6e6fe2c5f439361db4e95ddf43f000f

SHA512
ce54cce5faaa96394c71bb79ed94296529c4e02d4208f75cc5fc20ce36f6f1ec6bf462c43724868b7a30a95d0cf19bf25f16d36bb8dcb8b38b03b250368f089b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
28KB

MD5
c69548309dc9db5cb3982cdd67361809

SHA1
b2ad2b0753eff8a7d487d7acd8aff5b8aefcbf98

SHA256
e1b07cfa09e78ab9a2c1a9e8ad23bbc0b6e6fe2c5f439361db4e95ddf43f000f

SHA512
ce54cce5faaa96394c71bb79ed94296529c4e02d4208f75cc5fc20ce36f6f1ec6bf462c43724868b7a30a95d0cf19bf25f16d36bb8dcb8b38b03b250368f089b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\logo-saas-1-150x150[1].png
Filesize
3KB

MD5
18bd5d1f8c82c9496f2a12b5d6c4ec52

SHA1
a13f6eea1e217d1ae05838f635faabe5674066ad

SHA256
c6e8eb65a3e2fb188e8eb3b39393050a01dd27eda043c5defba8d8d4cb523462

SHA512
c86be7c607a310c9942807a240081fbd2dafcb855110c9ac89574e3b72a07ea76de5e57f05097b82ccb8b9f7783d8e42d4d52e5c2a572ede212cb0f28c1922dd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\activity-stream.discovery_stream.json.tmp
Filesize
133KB

MD5
18ed8891a95695b6a54ddd5734644031

SHA1
07268933a7a1717461da435eb340f4f31348e04f

SHA256
5c3ddb5a1d34c7f3c00146385e3fa07ce23896d4b44a96687996acbe8a1182cc

SHA512
362d614ca27ff6cde74f475dc5b066625a981d22ae5b206f18eb868a27e9ecd72f60914b1329981d53f64e0ba963631197642b9926b6a599ec8565c90f577524

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOC597A6E8\Keygens.txt
Filesize
603KB

MD5
9c2b895666de710efe833d68029ab0a0

SHA1
79ca6e16584ae49fff69812b24e77395d948c95f

SHA256
34f183b05ebbcef2a504c7b719ddd737e1943bf6cd2b5614fd77d21f510fed83

SHA512
664104244f826945f3287f74cd4730ac6410635dbcf486b942331d92b1d92cc28b836868905b554bbb09017c5520a5b6a36e30a52ba7859be153fa025fc16d07

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOC59FD5D7\Satups.exe
Filesize
929.1MB

MD5
48afb6720e4dd558a947c0e38d14b6c3

SHA1
0c1c4322a0c93685de64fe7dd159eb77b5acc3fa

SHA256
1cbb8cb840c530a488367b853891c32577616750ce84de7e27b31fbf8a935bff

SHA512
70b2ab1f85823e38bbf32fb9ad00e02c431659129b8cccce2b103bccc86d60afaf747b1c9869d2d8245180e577ae9550eb83a3f4ba3ae50d7bbdaf78106e023c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOC59FD5D7\Satups.exe
Filesize
889.4MB

MD5
4626b73dc618659f2ba8690e141edaf4

SHA1
79db240d5ab0f6a5bdfe4b02288f480006b3f16b

SHA256
7d08d342bfacf79f23a86c42fd708965bef0f06949f1aa56554bd9f4c78e1478

SHA512
5e3d518e4b91f9be50f954149ed424d74bd43a69ec6f1d67a473d5ad5b65739a239bcbba087a343c4566c54613e60297645e90a6bec5c292fc20236a3a155b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOC59FD5D7\Satups.exe:Zone.Identifier
Filesize
327B

MD5
4b9cefc42841a5d922657901274e9563

SHA1
fcb51664765399c10f376f704532bff42dcdf354

SHA256
dbd08f6f9e49f93d905bd3912e348b4f06f6fa20c9c203e1c753948293bb539b

SHA512
71c3902aaa0cc8714bbe2620e6342f328a5e6ab32c07cf504b7fc11cf056c28d7326d0849801a2e2e82a77aa2a3007e0713328789c83b09b3339e45bef2b113e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF401B4A2589DA9111.TMP
Filesize
16KB

MD5
60f7a9e4fa105b854f94186d221836e1

SHA1
3663ffad14c5f2b4a91d86fb5a98e6da558ca01d

SHA256
a3e2f79e2e54c11e7d140733639ae2113092facd34dc80bd6ba55084904461a4

SHA512
8f208c7f5e461cef3302e60ff3b976b22df1a4863bfe5840a581e975bb0d585e2042648dc0060da37789eb31beaac12e90620a0ac8b56d48b0da1387c2b30f80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
6KB

MD5
27686391c3c129bd9fe501e4c84064d0

SHA1
272a32541bd26f9e90ea30904d7945a17f534e74

SHA256
605c9dbc77c4aae57da8bdaa3b413d2a1de550a5e640a58271a05c7e822dbc8f

SHA512
836a951216b1dc589ab0fbd64c966ba902593d6d7005c577bcd467714d1c3fbcd652b186eec5f975ea5a498de400aab55ef8e1eb6d66083395b4182b83d9838f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
6KB

MD5
94f453be13dbfa9b0f516d4d4fc90d99

SHA1
6f6ffc391b978e7c833bf248af6ad41fc30a0534

SHA256
eaaeb29ffdcccaa69320360ce207060d435320989a0228686718ad3486155954

SHA512
7379b6f73507f3242150810fbf834811c5552f422a8ebde70777bd8f157e95efce8bae234f02bef48c785d0184b4bb7307cbe54ee46aca66f12f9586c97409ce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
6KB

MD5
48b9c25750e1aa239da9819b9b36e6f5

SHA1
4eb2494e45d2814bd82da90f27074ed0e596555b

SHA256
35006f38c672205a68127650a5ed812bc0a3ea10f0f0470cf9d61c34a84b0cea

SHA512
3cb852f7db6b4fafb6032029bb781b9226e9b392354f031a78dcda990f5de452c698ea637cba6f92366116112c4754e71238f38ed27a0f39a48bbb4260aa8b9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
7KB

MD5
af94ab18ccf87e1b0032818376a19292

SHA1
9b1d082a9c0a5c8bcc420bf108e3030d8558abb4

SHA256
e0cca5129270dc97861209f38eb4198c0690112fa910cd4ec752cc9326da834a

SHA512
8c2e16fe7bd53f7b412e3e830b19224add79e34f35823fa5540f279d79693d10709bb449fe0406135f5035a1e3901ace694e9f2f576f4bdf810a67c2060cad71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
7KB

MD5
64c2f229634007563d791a591cfab167

SHA1
8c906ff273e4e8f1383bbb0410970bf2cec787c9

SHA256
a17049f62b43b139cb54601aecaba3ac739704d5ff300e611a9a95c90cbd8cd2

SHA512
a664a10ca71a2be284ed14b9d9223aafbbc91005a8f624965cd465600e018ab57c1ef55ae66a3f00a5c4ec74498f6a6153c2425a0367d37753b607fd0c7b4d63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
7KB

MD5
2783e731d5d5a74bd6ee66658d56b3f7

SHA1
0f8c6bf44a5f43bc44199f52fde7efbdbdb1a728

SHA256
e356a1079514de2fc62fe6e21f86f89fe1c5922a10d6a14a05a43519fe5e66a1

SHA512
89f154c62a22f9e108b68d3165624b28dbf9968018a6aff0e9c1fadcdcfb5d38f84e1e4ccc38ee352bdd2bdb23fe372b0f01d239a19cd57135cfda63516d4b73

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
6KB

MD5
5f8b6433620684e65fd9998483c5daf0

SHA1
370724d8d8a0eaf494bf9452808b9b6810282c38

SHA256
0059297e15214cf7ed35da706a8d44a8b4b660957bf85d8517306e31d229801d

SHA512
f66fb76a98026825ef5493ca9fedba4543ccf48f7223c3f606f502ed23da835d9d7939bb7a331bfa90e8748c468d15e79cc1dabc11de5f7ce39281f8ea3ca5be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs.js
Filesize
6KB

MD5
fcd5f37e5e4066f7cffe8eb106b6ce19

SHA1
b0a1c4d3d5c96271429fb09cb71055d177c13402

SHA256
38dbdb91f24f8e138803d71d0f7e4758fbb78e7f657208325fe30a501e225c67

SHA512
afdf7697bc784c3c85f30a8a1e4caa32459cf7f19c1ffacde04f62f089218ff1899ffe69fc465677d719546c8f91bea0d04807b13d58096f79aeba8eef0a0a15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionCheckpoints.json.tmp
Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
e9c165361d4d9593e1f5e35c5526a2a9

SHA1
d22650cdc97eacd6fa7d0a8244582b5989bc13ae

SHA256
180861d14c8b325fc40f16e47da10ea5c8dbd06a282d4063caee520a92b41460

SHA512
20c647e3aff3fc7017e010249266ce0b1b07ec343dc36880fed9cc1fb6c325b17030380719a72a12cd57822ecc5c20681399be73d3c41dff8412a704e7445e43

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
bcfe52d933cb5c44cd23fa6754be72cb

SHA1
3866d224f416de080efae78e19b1f72beef15103

SHA256
b39a2ed91b572f5c58aec50eb1868592c0f3c822a64e3125fd225a657e61d095

SHA512
4722b4352cb1efb588d262380b5ba286769e2b6182d7ef5159cbdd83d12e099684f6313728cd93edbe4a8e8fcf4db992c1beb573513297caf6f0a95c0e398235

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionstore.jsonlz4
Filesize
7KB

MD5
123900948b2f07fe629cd24dfe18717d

SHA1
41d5a1d23edfd9c2115d4e6a79a5aecadfe4fb09

SHA256
59c307099a14ef8206d0a85f00e0d89f28aa57934b79dc7e3632445ee0f29a55

SHA512
1fca05eda0cdd81e147b382fab6e57ae648a8259c423bb542dce22b6b36221785c8fb0eda486d51b30ac1dbb2e8b6d8e4f3353503ae1bb97fc8ee051cc5cbf25

Download Submit
C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49.JIJQKfjL.rar.part
Filesize
32KB

MD5
f7a7482d4b95a330365ca858c06359d4

SHA1
40cc30a72c2d284e5e4e8e8a0b276e297c53781e

SHA256
36b5a9292ba2c7d4dbfaacefc5c1fd99f9caec36d369ad6e105c2eebcfc2a69c

SHA512
e2a4d4b32242c7d52de67c952bf8ae9d83f7b98972db49ad0acc9e3c687f03a2ca6d9175bbcacaa6ff7d5340ae2e0d2cb16c0e5ffb13e6abddfcbf9425481908

Download Submit
C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49.rar
Filesize
4.5MB

MD5
200d17f5484cb02bbe2b1779a00c5546

SHA1
0fdb73a974f492af8b0ef1a9634f669f0f1ec50c

SHA256
08d037d43adce053232adf00915fa45e7864f20221bba87b5bbdb995551f124f

SHA512
1b5f11456daa47f41e4a4222cc44e1e33da2155feaebdb0941cc77c534a322e71c13c4f3d20ecc7b3cde3a9e64a82a112b19ea165d609851c9dd1b500906db7f

Download Submit
C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Keygens.txt
Filesize
603KB

MD5
9c2b895666de710efe833d68029ab0a0

SHA1
79ca6e16584ae49fff69812b24e77395d948c95f

SHA256
34f183b05ebbcef2a504c7b719ddd737e1943bf6cd2b5614fd77d21f510fed83

SHA512
664104244f826945f3287f74cd4730ac6410635dbcf486b942331d92b1d92cc28b836868905b554bbb09017c5520a5b6a36e30a52ba7859be153fa025fc16d07

Download Submit
C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\ProSatupsGet+.rar
Filesize
4.1MB

MD5
5c0e8e3fe03aa3f21d60110f413ddc7a

SHA1
b4d4b656ff61c5258f6d9081b38a75042764172c

SHA256
43d5d06f032f273a906d27a13c83c0eadda5f7c3f7b9c21e01061c20bd296a1b

SHA512
c837a109c815a4610f5be0e21c6760b6f83f73560ada457db5842d3b3cd927bcfd37439c467961dc6abfe49e63ba07453bb1874f329276b870932315a1497f82

Download Submit
C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe
Filesize
493.3MB

MD5
0485db81cd60deb232e6ae0ffbf0a1a8

SHA1
963497719dc66c559a22b90b6e923be4f10a8e9e

SHA256
4ecf5444384ac2449809df033b92d36d53b3dc437c6e5c5aba137bf0f851e36b

SHA512
0e6b4e4f473f27f2f079efe229aab1d3826fb10eebac3c23b55fd2118c6ce49cd551a46c26efb53b7ce8e075b0eeb2eba0a1234b2c9fa855b76303364c13d243

Download Submit
C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe
Filesize
512.6MB

MD5
b2bb0636badccf95d3b2b2548bbb1ee1

SHA1
d260cf9ae3071532f45b06d7c6e86d3389d352f2

SHA256
065473c95a53443d4004d25877f7e35962d22e2c59c0cff4576c23b0af55cfd6

SHA512
85dab7a248a6dab909e3527c75afd850531a0c6a46c2d0768d5a756ca091c4a9c016e486182b06631c7bb7f63f4bdfa34413afcc2496f305890cfa1ebe6e3184

Download Submit
C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe
Filesize
561.5MB

MD5
61a7d80ef5ba6892aecfe9f5a268f4f6

SHA1
e268883fb3584d37aac43b8483e1e1813ddde4e9

SHA256
1a0135e24149fbaef27e926be0d0d4ec41d8234389067e93210df732c1583e7e

SHA512
b567608de1b64e74f5a7934c9616c60a25949b59008d1dbce0c65ac0f73401340616653e8137c2f16323e58e799460caa61ac4e59593a0d3ac63a28e00e09208

Download Submit
C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe
Filesize
394.8MB

MD5
702e5abd413d4adf243e182eab3b80e0

SHA1
89525fb7b1abdaa9ffdfc7fc522783656fcc1ec8

SHA256
109c9fea4444923afd878f1f4a648d3c89fe76195c4a36bda7f3048f1e44447c

SHA512
b0de4845ae7799cd2625deadd8477b377d822ff8170bf8b64adf04305ee7c4c164d3dacebc4168a2e90368de2ae6087ef262772731a4ab37b2c0eac140e78e6f

Download Submit
C:\Users\Admin\Downloads\KeyyPaass-2023-SatupFileW49\Satups.exe
Filesize
382.6MB

MD5
266995d9b38ad03c32707850c2b404ed

SHA1
765b977ad4dbfe2c790946df95878867f2f1618a

SHA256
5db6c7616ba671f307de81d5033fcc5f0f39a298c8fcc15df2227acd81d3b7c9

SHA512
5b028a91cc1b932141918ad1a7b07ee6ebb74bbb124f11728d8d57e98185d7a92d77faf64cfed3a76986ffb9506a565394df147b13ede54b2bed785e4723eeb1

Download Submit
\??\c:\users\admin\appdata\local\temp\7zoc59fd5d7\satups.exe
Filesize
956.9MB

MD5
8b684f4280972ff595ca0f63ebd06dd7

SHA1
9fa3811acdd82ea801cffa90c2f953508f2a1971

SHA256
5260e86bbcb28a1ea1a4301bf85d197463b1dd4045153766b294ad5712dcd3d1

SHA512
37b4935120051ac4809af91fd88dc1fb8c449c0ab737472978206ccccb9c34b6115c00481810efd107c8c0ab820ad6bddd1abcf264ba7e935d7d8fc3406b4c02

Download Submit
memory/1008-2416-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/1008-2395-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/1008-2389-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/1008-2399-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/1008-2397-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/1084-2144-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/1084-2152-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/1084-2148-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download
memory/1084-2140-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/1084-2149-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/1084-2143-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/1084-2138-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/1084-2139-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/1084-2131-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/1084-2130-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/3188-2217-0x00000249BC800000-0x00000249BC801000-memory.dmp

Filesize
4KB

Download
memory/3188-2218-0x00000249BC800000-0x00000249BC801000-memory.dmp

Filesize
4KB

Download
memory/3188-2226-0x00000249BC800000-0x00000249BC801000-memory.dmp

Filesize
4KB

Download
memory/3188-2227-0x00000249BC800000-0x00000249BC801000-memory.dmp

Filesize
4KB

Download
memory/3188-2229-0x00000249BC800000-0x00000249BC801000-memory.dmp

Filesize
4KB

Download
memory/3188-2230-0x00000249BC800000-0x00000249BC801000-memory.dmp

Filesize
4KB

Download
memory/3188-2231-0x00000249BC800000-0x00000249BC801000-memory.dmp

Filesize
4KB

Download
memory/3188-2228-0x00000249BC800000-0x00000249BC801000-memory.dmp

Filesize
4KB

Download
memory/3188-2216-0x00000249BC800000-0x00000249BC801000-memory.dmp

Filesize
4KB

Download
memory/4884-1333-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/4884-1331-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/4884-1367-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/4884-1340-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/4884-1341-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/4884-1345-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/4884-1342-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/4884-1343-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/4884-1344-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/4884-1339-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/5360-1286-0x0000022316120000-0x0000022316121000-memory.dmp

Filesize
4KB

Download
memory/5360-1307-0x0000022316120000-0x0000022316121000-memory.dmp

Filesize
4KB

Download
memory/5360-1289-0x0000022316120000-0x0000022316121000-memory.dmp

Filesize
4KB

Download
memory/5360-1299-0x0000022316120000-0x0000022316121000-memory.dmp

Filesize
4KB

Download
memory/5360-1296-0x0000022316120000-0x0000022316121000-memory.dmp

Filesize
4KB

Download
memory/5360-1285-0x0000022316120000-0x0000022316121000-memory.dmp

Filesize
4KB

Download
memory/5360-1302-0x0000022316120000-0x0000022316121000-memory.dmp

Filesize
4KB

Download
memory/5360-1298-0x0000022316120000-0x0000022316121000-memory.dmp

Filesize
4KB

Download
memory/5360-1297-0x0000022316120000-0x0000022316121000-memory.dmp

Filesize
4KB

Download
memory/5360-1306-0x0000022316120000-0x0000022316121000-memory.dmp

Filesize
4KB

Download
memory/5412-2415-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/5412-2390-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/5412-2396-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/5412-2400-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/6064-2155-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/6064-2116-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/6064-2117-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/6064-2115-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/6064-2113-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/6064-2112-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/6064-2111-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/6064-2110-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/6064-2114-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/6064-2106-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download
memory/6064-2102-0x0000000000400000-0x0000000000B16000-memory.dmp

Filesize
7.1MB

Download