oski | 579e9d2e534610d36fa6073b825f8caffc41f1f20dad0cfd1749ca12d202a11c

Analysis

max time kernel
445s
max time network
446s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Oski Cracked.exe
Size

4.7MB
MD5

fae4c2fc795b054c80d57ad600f8447f
SHA1

94ef84328a4c1c864307870d8e98cc4b6d334dd5
SHA256

579e9d2e534610d36fa6073b825f8caffc41f1f20dad0cfd1749ca12d202a11c
SHA512

35da6d3abc97cea70fb573d45f5bd528f5550d478a464f40dd1455f453c65a16283d3a5106aa9e488d3674db5d0ec7009a0cfd30d026afc4220e829f32075be9
SSDEEP

98304:PahEJCbuSMburCaMZh0yEKj+WRvrY1dcZ048HV/bFy8jJ7LUdVmi:PahmmMbuQZlFY7KsZPNLUdQ

Score

10^/10

oski quasar venomrat windows security evasion infostealer persistence rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Windows Security

23.105.131.187:7812

Mutex

VNM_MUTEX_CXpgUhDot7jvhF7S9O

Attributes

encryption_key
1mVKopYcKhmQLOzLUk5T
install_name
Windows Security.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update Service
subdirectory
SubDir

Extracted

Family

oski

107.180.3.147

Signatures

Contains code to disable Windows Defender 6 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2432-31-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2432-33-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2432-42-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2432-40-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2432-37-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2012-153-0x0000000004D20000-0x0000000004D60000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Windows Security.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Windows Security.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Windows Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Windows Security.exe

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral1/memory/2432-31-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2432-33-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2432-42-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2432-40-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2432-37-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2012-153-0x0000000004D20000-0x0000000004D60000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Deletes itself 1 IoCs

pid	Process
1528	cmd.exe

Executes dropped EXE 48 IoCs

pid	Process
2944	Windows Security.exe
2152	Oski Cracked.exe
2432	Windows Security.exe
1628	Windows Security.exe
2012	Windows Security.exe
988	Windows Security.exe
1336	Windows Security.exe
2148	Windows Security.exe
1664	Windows Security.exe
1028	Oski Cracked.exe
1992	Windows Security.exe
2216	Windows Security.exe
540	Windows Security.exe
772	Windows Security.exe
1592	Windows Security.exe
2544	Windows Security.exe
1304	Windows Security.exe
1928	Windows Security.exe
2868	Windows Security.exe
576	Windows Security.exe
840	Windows Security.exe
2624	Oski_Cracked_107.180.3.147.exe
1124	Windows Security.exe
2776	Windows Security.exe
2732	Windows Security.exe
2208	Windows Security.exe
1812	Windows Security.exe
576	Windows Security.exe
580	Windows Security.exe
2348	Windows Security.exe
2424	Windows Security.exe
3684	Windows Security.exe
3720	Windows Security.exe
3380	Windows Security.exe
2144	Windows Security.exe
3944	Windows Security.exe
3848	Windows Security.exe
3460	Windows Security.exe
1960	Windows Security.exe
3132	Windows Security.exe
3472	Windows Security.exe
4048	Windows Security.exe
3632	Windows Security.exe
2584	Windows Security.exe
3756	Windows Security.exe
1828	Windows Security.exe
2520	Windows Security.exe
3000	Windows Security.exe

Loads dropped DLL 7 IoCs

pid	Process
2972	Oski Cracked.exe
2972	Oski Cracked.exe
2944	Windows Security.exe
2432	Windows Security.exe
892	WerFault.exe
892	WerFault.exe
892	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Windows Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	Windows Security.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe"	Windows Security.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\stub.bin	Oski Cracked.exe
File opened for modification	C:\Windows\system32\stub.bin	Oski Cracked.exe

Suspicious use of SetThreadContext 18 IoCs

description	pid	Process	procid_target
PID 2944 set thread context of 2432	2944	Windows Security.exe	30
PID 1628 set thread context of 2012	1628	Windows Security.exe	37
PID 988 set thread context of 1336	988	Windows Security.exe	48
PID 2148 set thread context of 1664	2148	Windows Security.exe	63
PID 1992 set thread context of 2216	1992	Windows Security.exe	71
PID 540 set thread context of 772	540	Windows Security.exe	77
PID 1592 set thread context of 2544	1592	Windows Security.exe	83
PID 1304 set thread context of 1928	1304	Windows Security.exe	89
PID 2868 set thread context of 840	2868	Windows Security.exe	98
PID 1124 set thread context of 2776	1124	Windows Security.exe	107
PID 2732 set thread context of 2208	2732	Windows Security.exe	113
PID 1812 set thread context of 580	1812	Windows Security.exe	120
PID 2348 set thread context of 2424	2348	Windows Security.exe	126
PID 3684 set thread context of 3720	3684	Windows Security.exe	142
PID 3380 set thread context of 2144	3380	Windows Security.exe	154
PID 3944 set thread context of 3848	3944	Windows Security.exe	161
PID 3460 set thread context of 1960	3460	Windows Security.exe	167
PID 3132 set thread context of 4048	3132	Windows Security.exe	174

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	Oski Cracked.exe
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	Oski Cracked.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	firefox.exe
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
892	2624	WerFault.exe	99

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1696	schtasks.exe
2380	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000590a3a33f2f608dc39aad7662e5183fa77f0d47157844138e1440f9fda61c8ae000000000e80000000020000200000000c369567639d7ea332a6c6e7e76d9a3f6529d19d9ab0a803771ed9d721603ca090000000e6e2a4955701940453d05698f2f0e04a0b3488bec9c8abe0c0fcf92abf904a591dff6dee38de12d2af32ab9ab2c4573fefe07454f29853b5052cdf83a9d9655e5bdc9105f8516fc386a2c034bf9610c4765c3432b51a21b507bb8345cd1ac3717c10608e033f4d3af474e70aa74c0e6a68c3a6f2284487655ee22a58c844a917ef6543d3443af740dcb242897ae3da914000000078eca86d8ee5e7186341449c12a687cc9b528c66cc64a935e8734a065ecc5812d5a71b6835888f95c3f71d57de951e35580f7fe37bba682dbecb1d4a34261de6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418494720"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f6bd827287da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE0AEC71-F365-11EE-9969-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000007f356fd41883ce2425d87498c944e777f2d74fd48ef206d577aa76e458d142fc000000000e80000000020000200000003dbed80296f9711af52241f46f1a540502fe3118718e8a86a226843903260326200000008260da769f85bb7396b47d4fea3d828a0a2e5a66d4b1c2f469815601942ba4dc40000000170a5c4392ff455c6f986fd3719d32e36dc8b4bad98b0f20c2f348de7568e34a63928d717ff01ba494c81cc8ff47d53088f9662d580ba14ea6e753138c0f2ca1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	Oski Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Oski Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Oski Cracked.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 0100000000000000ffffffff	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	Oski Cracked.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Oski Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	Oski Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000030000000100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Oski Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Oski Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\1 = 52003100000000005558d675100057696e646f7773003c0008000400efbeee3a851a5558d6752a0000008a020000000001000000000000000000000000000000570069006e0064006f0077007300000016000000	Oski Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\1\MRUListEx = 00000000ffffffff	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\1\0\NodeSlot = "9"	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\1	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	Oski Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\1\0\MRUListEx = ffffffff	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Oski Cracked.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000030000000100000000000000ffffffff	Oski Cracked.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "10"	Oski Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	Oski Cracked.exe

Runs ping.exe 1 TTPs 17 IoCs

Remote System Discovery

T1018

pid	Process
2288	PING.EXE
3028	PING.EXE
2712	PING.EXE
1640	PING.EXE
1664	PING.EXE
1616	PING.EXE
2032	PING.EXE
4036	PING.EXE
3856	PING.EXE
1804	PING.EXE
2792	PING.EXE
1984	PING.EXE
4056	PING.EXE
3808	PING.EXE
1544	PING.EXE
900	PING.EXE
2728	PING.EXE

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
1508	powershell.exe
2432	Windows Security.exe
2432	Windows Security.exe
2432	Windows Security.exe
2432	Windows Security.exe
2432	Windows Security.exe
2432	Windows Security.exe
2432	Windows Security.exe
1336	Windows Security.exe
1664	Windows Security.exe
2216	Windows Security.exe
772	Windows Security.exe
2544	Windows Security.exe
1928	Windows Security.exe
2868	Windows Security.exe
2868	Windows Security.exe
840	Windows Security.exe
2872	iexplore.exe
2776	Windows Security.exe
2208	Windows Security.exe
1812	Windows Security.exe
1812	Windows Security.exe
580	Windows Security.exe
2424	Windows Security.exe
3720	Windows Security.exe
2144	Windows Security.exe
3848	Windows Security.exe
1960	Windows Security.exe
3132	Windows Security.exe
3132	Windows Security.exe
3132	Windows Security.exe
4048	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe
3632	Windows Security.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2012	Windows Security.exe
1800	firefox.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	Windows Security.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	2012	Windows Security.exe
Token: SeDebugPrivilege	2012	Windows Security.exe
Token: SeDebugPrivilege	1336	Windows Security.exe
Token: SeDebugPrivilege	1664	Windows Security.exe
Token: SeDebugPrivilege	2216	Windows Security.exe
Token: SeDebugPrivilege	772	Windows Security.exe
Token: SeDebugPrivilege	2544	Windows Security.exe
Token: SeDebugPrivilege	1928	Windows Security.exe
Token: SeDebugPrivilege	2868	Windows Security.exe
Token: SeDebugPrivilege	840	Windows Security.exe
Token: SeDebugPrivilege	2776	Windows Security.exe
Token: SeDebugPrivilege	2208	Windows Security.exe
Token: SeDebugPrivilege	1812	Windows Security.exe
Token: SeDebugPrivilege	580	Windows Security.exe
Token: SeDebugPrivilege	2424	Windows Security.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	3720	Windows Security.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	2144	Windows Security.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	3848	Windows Security.exe
Token: SeDebugPrivilege	1960	Windows Security.exe
Token: SeDebugPrivilege	3132	Windows Security.exe
Token: SeDebugPrivilege	4048	Windows Security.exe
Token: SeRestorePrivilege	2716	7zG.exe
Token: 35	2716	7zG.exe
Token: SeDebugPrivilege	3632	Windows Security.exe
Token: SeSecurityPrivilege	2716	7zG.exe
Token: SeSecurityPrivilege	2716	7zG.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2872	iexplore.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
2716	7zG.exe
1800	firefox.exe
1800	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
2012	Windows Security.exe
2872	iexplore.exe
2872	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
1028	Oski Cracked.exe
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2944	2972	Oski Cracked.exe	28
PID 2972 wrote to memory of 2944	2972	Oski Cracked.exe	28
PID 2972 wrote to memory of 2944	2972	Oski Cracked.exe	28
PID 2972 wrote to memory of 2944	2972	Oski Cracked.exe	28
PID 2972 wrote to memory of 2152	2972	Oski Cracked.exe	29
PID 2972 wrote to memory of 2152	2972	Oski Cracked.exe	29
PID 2972 wrote to memory of 2152	2972	Oski Cracked.exe	29
PID 2972 wrote to memory of 2152	2972	Oski Cracked.exe	29
PID 2944 wrote to memory of 2432	2944	Windows Security.exe	30
PID 2944 wrote to memory of 2432	2944	Windows Security.exe	30
PID 2944 wrote to memory of 2432	2944	Windows Security.exe	30
PID 2944 wrote to memory of 2432	2944	Windows Security.exe	30
PID 2944 wrote to memory of 2432	2944	Windows Security.exe	30
PID 2944 wrote to memory of 2432	2944	Windows Security.exe	30
PID 2944 wrote to memory of 2432	2944	Windows Security.exe	30
PID 2944 wrote to memory of 2432	2944	Windows Security.exe	30
PID 2944 wrote to memory of 2432	2944	Windows Security.exe	30
PID 2432 wrote to memory of 1696	2432	Windows Security.exe	32
PID 2432 wrote to memory of 1696	2432	Windows Security.exe	32
PID 2432 wrote to memory of 1696	2432	Windows Security.exe	32
PID 2432 wrote to memory of 1696	2432	Windows Security.exe	32
PID 2432 wrote to memory of 1628	2432	Windows Security.exe	34
PID 2432 wrote to memory of 1628	2432	Windows Security.exe	34
PID 2432 wrote to memory of 1628	2432	Windows Security.exe	34
PID 2432 wrote to memory of 1628	2432	Windows Security.exe	34
PID 2432 wrote to memory of 1508	2432	Windows Security.exe	35
PID 2432 wrote to memory of 1508	2432	Windows Security.exe	35
PID 2432 wrote to memory of 1508	2432	Windows Security.exe	35
PID 2432 wrote to memory of 1508	2432	Windows Security.exe	35
PID 1628 wrote to memory of 2012	1628	Windows Security.exe	37
PID 1628 wrote to memory of 2012	1628	Windows Security.exe	37
PID 1628 wrote to memory of 2012	1628	Windows Security.exe	37
PID 1628 wrote to memory of 2012	1628	Windows Security.exe	37
PID 1628 wrote to memory of 2012	1628	Windows Security.exe	37
PID 1628 wrote to memory of 2012	1628	Windows Security.exe	37
PID 1628 wrote to memory of 2012	1628	Windows Security.exe	37
PID 1628 wrote to memory of 2012	1628	Windows Security.exe	37
PID 1628 wrote to memory of 2012	1628	Windows Security.exe	37
PID 2012 wrote to memory of 2380	2012	Windows Security.exe	38
PID 2012 wrote to memory of 2380	2012	Windows Security.exe	38
PID 2012 wrote to memory of 2380	2012	Windows Security.exe	38
PID 2012 wrote to memory of 2380	2012	Windows Security.exe	38
PID 2432 wrote to memory of 2400	2432	Windows Security.exe	40
PID 2432 wrote to memory of 2400	2432	Windows Security.exe	40
PID 2432 wrote to memory of 2400	2432	Windows Security.exe	40
PID 2432 wrote to memory of 2400	2432	Windows Security.exe	40
PID 2400 wrote to memory of 1528	2400	cmd.exe	42
PID 2400 wrote to memory of 1528	2400	cmd.exe	42
PID 2400 wrote to memory of 1528	2400	cmd.exe	42
PID 2400 wrote to memory of 1528	2400	cmd.exe	42
PID 2432 wrote to memory of 2396	2432	Windows Security.exe	43
PID 2432 wrote to memory of 2396	2432	Windows Security.exe	43
PID 2432 wrote to memory of 2396	2432	Windows Security.exe	43
PID 2432 wrote to memory of 2396	2432	Windows Security.exe	43
PID 2396 wrote to memory of 348	2396	cmd.exe	45
PID 2396 wrote to memory of 348	2396	cmd.exe	45
PID 2396 wrote to memory of 348	2396	cmd.exe	45
PID 2396 wrote to memory of 348	2396	cmd.exe	45
PID 2396 wrote to memory of 1544	2396	cmd.exe	46
PID 2396 wrote to memory of 1544	2396	cmd.exe	46
PID 2396 wrote to memory of 1544	2396	cmd.exe	46
PID 2396 wrote to memory of 1544	2396	cmd.exe	46
PID 2396 wrote to memory of 988	2396	cmd.exe	47
PID 2396 wrote to memory of 988	2396	cmd.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Oski Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\Oski Cracked.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Roaming\Windows Security.exe
  "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Roaming\Windows Security.exe
    "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Windows Update Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Security.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1696
  - - C:\Users\Admin\AppData\Roaming\SubDir\Windows Security.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Windows Security.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1628
    - - C:\Users\Admin\AppData\Roaming\SubDir\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows Security.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2012
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows Update Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Security.exe" /rl HIGHEST /f
        6⤵
        Creates scheduled task(s)
        
        PID:2380
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1508
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
        5⤵
        Deletes itself
        
        PID:1528
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\UHgBUVJdsO9H.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:348
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:1544
    - - C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:988
      - C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1336
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ctITPSzLobCS.bat" "
        7⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:2288
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2148
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CLsaCBl2LGDG.bat" "
        10⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:1804
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1992
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\bccuGV37pPei.bat" "
        13⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:2792
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:540
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PaLMLYgXoFaY.bat" "
        16⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        17⤵
        
        PID:300
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:3028
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1592
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\F3EeBou2U3PI.bat" "
        19⤵
        
        PID:568
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        20⤵
        
        PID:496
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:900
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1304
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tzXutd3VvTFR.bat" "
        22⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        23⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:2728
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        24⤵
        Executes dropped EXE
        
        PID:576
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\fRbRx88h4TNH.bat" "
        25⤵
        
        PID:300
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        26⤵
        Runs ping.exe
        
        PID:2712
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1124
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\m6iaTQlpWPPi.bat" "
        28⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        29⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        29⤵
        Runs ping.exe
        
        PID:2032
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2732
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        30⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\GsPS5gpIDJRy.bat" "
        31⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        32⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        32⤵
        Runs ping.exe
        
        PID:1640
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        33⤵
        Executes dropped EXE
        
        PID:576
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        33⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\S2U99vEps12D.bat" "
        34⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        35⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        35⤵
        Runs ping.exe
        
        PID:1984
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2348
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        36⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\D0PsREhwK3H9.bat" "
        37⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        38⤵
        
        PID:900
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        38⤵
        Runs ping.exe
        
        PID:1664
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        38⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3684
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        39⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\bG9BVYz1pCja.bat" "
        40⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        41⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        41⤵
        Runs ping.exe
        
        PID:4036
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3380
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        42⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NjDjZ34CyBqR.bat" "
        43⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        44⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        44⤵
        Runs ping.exe
        
        PID:4056
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        44⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3944
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        45⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3848
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\883rzijmqBEn.bat" "
        46⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        47⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        47⤵
        Runs ping.exe
        
        PID:3808
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3460
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        48⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Qp56ctuhheQq.bat" "
        49⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        50⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        50⤵
        Runs ping.exe
        
        PID:3856
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        50⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3132
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        51⤵
        Executes dropped EXE
        
        PID:3472
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        51⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4048
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\HodJUghRCI3a.bat" "
        52⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        53⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        53⤵
        Runs ping.exe
        
        PID:1616
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        53⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3632
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        54⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        54⤵
        Executes dropped EXE
        
        PID:3756
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        54⤵
        Executes dropped EXE
        
        PID:1828
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        54⤵
        Executes dropped EXE
        
        PID:2520
        
        C:\Users\Admin\AppData\Roaming\Windows Security.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
        54⤵
        Executes dropped EXE
        
        PID:3000
- C:\Users\Admin\AppData\Roaming\Oski Cracked.exe
  "C:\Users\Admin\AppData\Roaming\Oski Cracked.exe"
  2⤵
  - Executes dropped EXE
  PID:2152
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://t.me/lenskiyteamoff
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2872
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2556
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:537613 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2156

C:\Users\Admin\AppData\Roaming\Oski Cracked.exe
"C:\Users\Admin\AppData\Roaming\Oski Cracked.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1028

C:\Users\Admin\Desktop\Oski_Cracked_107.180.3.147.exe
"C:\Users\Admin\Desktop\Oski_Cracked_107.180.3.147.exe"
1⤵
- Executes dropped EXE
PID:2624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 784
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:892

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1644
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.0.2062618331\1113324928" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e704a2b2-8ff9-49ec-a280-f96278d4f03e} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 1288 44ce158 gpu
    3⤵
    PID:2524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.1.236767763\1024414247" -parentBuildID 20221007134813 -prefsHandle 1480 -prefMapHandle 1476 -prefsLen 20830 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebe5387c-b308-4a24-bd6c-58f1143b316c} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 1492 d72e58 socket
    3⤵
    PID:2408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.2.450236352\1257253720" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 20868 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {27cad691-836b-4ec1-90f5-e61a72e9b54b} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 2104 4461058 tab
    3⤵
    PID:2868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.3.654602026\734190437" -childID 2 -isForBrowser -prefsHandle 1652 -prefMapHandle 616 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3defcc81-eb6a-4453-bfac-5e93f70a2229} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 620 d70a58 tab
    3⤵
    PID:1504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.4.657342496\284632040" -childID 3 -isForBrowser -prefsHandle 616 -prefMapHandle 2748 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c2b9eaf-d0b6-4139-88c8-520099690470} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 2848 d6ab58 tab
    3⤵
    PID:812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.5.1727427651\277212184" -childID 4 -isForBrowser -prefsHandle 3644 -prefMapHandle 3016 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb47bf3f-bb2b-4890-8211-414d8f532bda} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 3652 1b3e1f58 tab
    3⤵
    PID:3272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.6.1122737767\647941483" -childID 5 -isForBrowser -prefsHandle 3760 -prefMapHandle 3764 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed2e5eab-46ef-4a6c-af7d-74a35a8ef95f} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 3748 1f005c58 tab
    3⤵
    PID:3288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.7.954017914\1484719765" -childID 6 -isForBrowser -prefsHandle 3948 -prefMapHandle 3952 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a3ae2f7-f236-46f7-936a-96b4a298c48f} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 3936 1f005358 tab
    3⤵
    PID:3304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.8.373156310\25296551" -childID 7 -isForBrowser -prefsHandle 4376 -prefMapHandle 4372 -prefsLen 26251 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08d560bd-b998-4abb-b0f0-2eb7cd182785} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 4388 2201c958 tab
    3⤵
    PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.9.1532304232\411062042" -childID 8 -isForBrowser -prefsHandle 3664 -prefMapHandle 3660 -prefsLen 26426 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5361abe-2aca-488a-8320-1ee2dcbf0b8e} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 3716 170f6858 tab
    3⤵
    PID:3688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.10.463112350\2025854345" -childID 9 -isForBrowser -prefsHandle 5224 -prefMapHandle 5184 -prefsLen 26426 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {805cf93d-fccd-4665-a7f6-be68d03ae708} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 5232 117e9658 tab
    3⤵
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.11.1473743859\1649480294" -childID 10 -isForBrowser -prefsHandle 5348 -prefMapHandle 5352 -prefsLen 26426 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {223d804b-2e3d-4165-8a66-e7de42e57f4d} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 5336 1c1d0258 tab
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.12.1712253411\490184178" -childID 11 -isForBrowser -prefsHandle 3684 -prefMapHandle 3704 -prefsLen 26426 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f3bbed9-b7a4-405b-bef9-d6045312227c} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 4044 170f7d58 tab
    3⤵
    PID:3948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.13.1898452481\996053145" -childID 12 -isForBrowser -prefsHandle 1924 -prefMapHandle 5188 -prefsLen 26426 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {918069ca-d62b-4641-b312-13f3bafa52e0} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 2788 170f6858 tab
    3⤵
    PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.14.322466673\282229811" -childID 13 -isForBrowser -prefsHandle 9372 -prefMapHandle 9224 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5671abac-7cff-4d5e-9d1c-c623deddf071} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 4872 1d497358 tab
    3⤵
    PID:2732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.15.194956036\1941418095" -childID 14 -isForBrowser -prefsHandle 3344 -prefMapHandle 4956 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a471950-979a-4070-b4b4-d6be60a121ed} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 9328 226ce458 tab
    3⤵
    PID:956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.16.711379946\1442860844" -childID 15 -isForBrowser -prefsHandle 8796 -prefMapHandle 8792 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55f24e27-63d6-4a98-a8e2-c85f8528765e} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 8808 22778858 tab
    3⤵
    PID:3848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.17.1132904380\1517516479" -childID 16 -isForBrowser -prefsHandle 8700 -prefMapHandle 8696 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53f94cc0-af37-4c03-bd19-a1e20dfce894} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 8712 227d9658 tab
    3⤵
    PID:1500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.18.2039887156\249833440" -childID 17 -isForBrowser -prefsHandle 9088 -prefMapHandle 9488 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ac722ac-5e78-4181-a2ee-0697105e54e3} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 9052 22fd2358 tab
    3⤵
    PID:4316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.19.986725485\1753027910" -childID 18 -isForBrowser -prefsHandle 8388 -prefMapHandle 8792 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {153d7cc5-4cdb-45f6-94a3-6a8048068493} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 8400 25838c58 tab
    3⤵
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.20.1816401432\1630499999" -childID 19 -isForBrowser -prefsHandle 8648 -prefMapHandle 8644 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8af990af-fa4d-4627-9a05-e6812e65e8b6} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 8636 2877cc58 tab
    3⤵
    PID:4920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.21.1322997210\1823457654" -childID 20 -isForBrowser -prefsHandle 7820 -prefMapHandle 7824 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1356172e-eb7b-4980-83ec-a1b1caab580f} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 7848 28722f58 tab
    3⤵
    PID:5004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.22.1402869126\1655693819" -childID 21 -isForBrowser -prefsHandle 7664 -prefMapHandle 7656 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a5e3463-7fdc-49f5-a4f8-2ebc905fe728} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 7676 28491858 tab
    3⤵
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.23.1723051198\1345085183" -childID 22 -isForBrowser -prefsHandle 7484 -prefMapHandle 7480 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {85890b1f-a5d7-4a03-b192-733b0ebc19b1} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 7496 28d26b58 tab
    3⤵
    PID:4544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.24.2089157365\1114148581" -childID 23 -isForBrowser -prefsHandle 7504 -prefMapHandle 7508 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e6a9dd2-060e-490a-9236-8de32d262bb5} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 7520 290f3258 tab
    3⤵
    PID:4820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.25.1119181910\217676097" -childID 24 -isForBrowser -prefsHandle 7112 -prefMapHandle 7116 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98af7cc1-a09e-47ce-b089-0b9daa1d442f} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 7196 27a26258 tab
    3⤵
    PID:5348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.26.1958861545\791449723" -childID 25 -isForBrowser -prefsHandle 7180 -prefMapHandle 7160 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b024049-534b-46b6-9bb0-0d302a4e0574} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 7256 29155f58 tab
    3⤵
    PID:5384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.27.765231048\1440535392" -childID 26 -isForBrowser -prefsHandle 7480 -prefMapHandle 7484 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8200483c-f46d-40d8-a8aa-c4c874d943b0} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 6992 29eb9558 tab
    3⤵
    PID:5396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.28.1485626113\1755076559" -childID 27 -isForBrowser -prefsHandle 7140 -prefMapHandle 7136 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55a1b8ff-28a4-4b2b-b7e3-4f49bce4284c} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 6908 29eb8358 tab
    3⤵
    PID:5424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.29.1427697185\1554665746" -childID 28 -isForBrowser -prefsHandle 6496 -prefMapHandle 6492 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d1b8395-39a6-478e-b560-bf96125df35f} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 6508 2ac79958 tab
    3⤵
    PID:5828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.30.1296225453\1729465422" -childID 29 -isForBrowser -prefsHandle 6464 -prefMapHandle 6468 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cdf2647-7c7d-4ace-a173-6bb1978c0f2d} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 6648 2b00fa58 tab
    3⤵
    PID:5844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.31.2057892658\1707126026" -childID 30 -isForBrowser -prefsHandle 6296 -prefMapHandle 6292 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {369dc868-9493-4f6e-9de5-f27b4ed3e7a5} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 6308 2b01ba58 tab
    3⤵
    PID:5936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.32.451458561\1061648766" -childID 31 -isForBrowser -prefsHandle 8680 -prefMapHandle 8160 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8d5a93d-8f65-42eb-af97-0b5d5b9f1ab5} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 6400 170f7a58 tab
    3⤵
    PID:2444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.33.1520426943\222301101" -childID 32 -isForBrowser -prefsHandle 7648 -prefMapHandle 7760 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26671e6c-be15-4c58-8192-7123e1f67cf9} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 7644 170f8f58 tab
    3⤵
    PID:3328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.34.317708400\1429850654" -childID 33 -isForBrowser -prefsHandle 7992 -prefMapHandle 7920 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {726f55b9-594e-41f6-b45c-090c0c94c278} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 7468 1e160058 tab
    3⤵
    PID:3720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.35.1778264691\640049183" -childID 34 -isForBrowser -prefsHandle 6332 -prefMapHandle 6344 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4accb847-f9d2-4d29-a1c1-2412a0123cae} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 6348 28d58758 tab
    3⤵
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.36.39199755\1516180368" -childID 35 -isForBrowser -prefsHandle 6620 -prefMapHandle 6668 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28ac902e-84e5-4f82-9f8b-14402b66451a} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 8300 2b01c658 tab
    3⤵
    PID:4884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.37.1353348048\492299390" -childID 36 -isForBrowser -prefsHandle 3284 -prefMapHandle 9300 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f84bc004-7010-4631-b106-ca43e7b77f0c} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 8944 2c12bb58 tab
    3⤵
    PID:2744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.38.668459026\1526139301" -childID 37 -isForBrowser -prefsHandle 7476 -prefMapHandle 6772 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02735360-1c17-4d90-8e5c-857febbafd5f} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 6480 1cdcc258 tab
    3⤵
    PID:3212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.39.175918408\130585562" -childID 38 -isForBrowser -prefsHandle 7812 -prefMapHandle 7808 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b68845d3-a93f-49a5-ac0a-4b554b3a92ac} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 7792 20b92058 tab
    3⤵
    PID:3960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.40.1564755334\395298411" -childID 39 -isForBrowser -prefsHandle 7536 -prefMapHandle 9200 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91d28d1a-4f72-4e71-83dc-4ebb5f625406} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 4960 d63858 tab
    3⤵
    PID:6092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.41.1458324501\123711993" -childID 40 -isForBrowser -prefsHandle 1668 -prefMapHandle 8616 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a23d909-4928-457f-b9c0-a7bdb672d404} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 8316 1a4fcc58 tab
    3⤵
    PID:3716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.42.27587089\1577757734" -childID 41 -isForBrowser -prefsHandle 7836 -prefMapHandle 7868 -prefsLen 26700 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {503205b9-52c3-415b-87b8-e869b12de1f4} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 9272 1a4fb458 tab
    3⤵
    PID:1660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.43.771581624\1522568008" -childID 42 -isForBrowser -prefsHandle 1600 -prefMapHandle 8380 -prefsLen 27391 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce142823-8f40-4324-83a8-2135ff4e6fa5} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 8196 27b1ed58 tab
    3⤵
    PID:1220

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap8019:110:7zEvent1002 -ad -saa -- "C:\Users\Admin\Desktop\Oski_Cracked_107.180.3.147.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\msvcp140.dll

Filesize
1KB

MD5
12bc9fcd7f59bd4a0c74e0477ccbad55

SHA1
9c866d208d2bc04fdc136dbc1fef2e889beb9cbf

SHA256
cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed

SHA512
ca540a17b3dbf25d336c46d68cc6d5a1251a697d81eae1ec8caf8ffd02154c408327982b8d2f17ccd67e897a40e632a5c41630ff6c85e95a82cb608a29237b31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a72ae425e38fc7f71fb8f180252cc87

SHA1
379a1d98212834f0456c5e19054dca95a5a00495

SHA256
f4b0edb739b917d2c3ad2e6017828221557c407e3357e3eeaeaded2f398d09ed

SHA512
1b07dfbb90110d3b791b257e1908046eccbaec1fcb95ad7c9562194499edc3002ea20336313b2ea6715dd5396838bb2559b2186708e83b60bc4566d536b1e2f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b8f9261544a7e4504ee48b6bb5adfbc

SHA1
fe261de6bfc8b064b01e4ce3b8f76df1ffc6aa06

SHA256
9f08344b1b57564ab0954b1943621f4326643cf019cf9bd26eba2e7f56fe4e25

SHA512
aeabe5cc0976917e22a25e4517781b29ef3046c6a5bbe193667d3c491fb398d92eb0989847089a9cd49ffbe415db494b80be4a8b8e3d4882e73c006fe2e1a988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ec2c67176bb1c5f376016f13c6ff632

SHA1
152330a558099b7ec98bcfdaa8767dd9b21f9ab6

SHA256
d389da6874b4e66d3122ff6c134351681885942a12c0fddbe3c4bd786c840ffd

SHA512
d6ea43e4377504df348fef90d51742941b5a8f53df138fb1a52cf95cac51f92af2021146a56a6a3ad0f745d2c70fe839f5ba03e159e093d2fcc5cc1ae0c3cc76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
402d898898f19ce8a9c9126583fdca18

SHA1
b00cb4b144289257ab7de9acbb6896d78a7d4d5c

SHA256
8dd57b0a0e6743c0f55db810ec0cf912d2a18d3bb15f8f844876134f24011359

SHA512
9178b9d7a073ad2e6a78b3e7b605196ff9477a3e474b2f8bef2a3f5434b32efdea4c886a9fa2cc9bc67939aa3772c6307abfa5cc3bc013e17accde11c3405476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a10e195d2d8f6d99bd03e664eb89ff91

SHA1
c0d084864e9f8d3b90e06280ff081fbf3f377fb5

SHA256
2f2e8da75b2cdc3510bcc2bd8e691e8fec41b9dc60f2e8890859880c931bd89e

SHA512
a34a8e98e4a95b3f231bea4f92faa02cf0658700c0ef81ef4cbc7ed276709e6209f4a7d7035cfcc9ebdfb37005046dd437b2647f6e44169f7920614d48e6973d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7456e28f22cd5d6c97237aef8dfc5295

SHA1
5d47139d0ce1343b693fe45264ce561cb1b8b2dd

SHA256
fd02e77edd495b0374892366b0a1d7936fdf36727233630aed6592571c4d0af5

SHA512
5f3992e6d00d906f496783ced3fb70e3234452641be7260b835dae729537e3f5b2c48582273d794b228d4edb5e5151671910dc055d57a12932fc56cbf3acb306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a0d3133d78394654fb44b4d607a65ef

SHA1
c07661d856c350622d2a073521dbecf50021d755

SHA256
886b2dbbdefc8efd62d9173ee73c51b452318a0d8c134f7e369819943b96476a

SHA512
28b9278eaf8dfdb828a6b01b7629bdae9b502dbf05d9e3f26f8e28ad891d52355701243e71103196d927b085f9a9cd08ee92dcbe92e47cb19e817f58ce6f5a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e52375a2ae6ed51c9790f1dbe9ab440

SHA1
36053a85e4adc0477b779b1f2acd275481a461a7

SHA256
1d0e9c643f407f9f7a38404eab9aae6b4bf7fa387b5f7afbaddb7aa019c65594

SHA512
f676107b658c879168348af532533b581834e80debdd518ff97a578c20c2ac65212b7f75e921862f9d0382e616f67f2a15b5859478d78c66acd11ac2bdc7f696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b79c38bd41c16ce4212a86d75598139

SHA1
b1da9e869de6920ec7696aad3c9feb4c101a1f94

SHA256
8c7954319ac8bf9d9db791e87147d7f8084c08711f93ce1534292155cfe47a72

SHA512
e39d98e733ef11931a82afd6b537662d21f1451cf30ad6261006afec8ce26c4564a711cc66ad1cbfd7e68a99c651a607bc61b604337fd0a83ecde9033ad96e2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c2987867dca854840ec2289a1e14a59

SHA1
5b878575d495fca5d79272b3fe1f067c0a553bf8

SHA256
122a001ea7d88ec24dfc93c0afd5f2b8d3f26bdc6c466e13bdb92f5ec406f494

SHA512
6ebf83b116d0b38c88732597a89e9d21fc85aa1ae10a8ee3bc9215bf317311858551a06fd8184500d19b283af03a80acb7130c38e4dfc3c82c774baaf54e78e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44d095858996a480298be49bbd8ec486

SHA1
7aab43353ea706a5aee1bcab9c90459c0daa89b4

SHA256
cfe14e2c2fc488ad44aa5cbae103814afebbd256a7ad848893504be7e979a877

SHA512
455e4f8de6e252adfba206422c41410fb5f7365a958b47f0c060bcb5d6d633f79321a17990bcfd22a5a19659cd5cef6115aa9d67d02a48a62ca4e924aa0eb589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a5c1785aa4216c323d722be91103867

SHA1
e97110cb77dc75657e10cf2a850493b9e0baef6f

SHA256
30b7384ab79f755291c78ed87e6ba88b3bae1b206e8f90fccd82c85c64013711

SHA512
7f9a16b5dbd22031e7fefdfa55f127087e87e38367c8afb19b42ab22eed717668fc04c7790a12f3f927045be3ffe2c9f4d227c4d9005e80f735fc1e6c3041b2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d1f24f82d6cbe1ffedeb19b6a06d4ff

SHA1
ee42ce5e6b19865a47ff380db5810903644146a0

SHA256
75854ec97abb727c6eade710b055c0a711def17c5b0163398a0a26182681b186

SHA512
4f4a2a5f8152cbdb79c4e7bc8514c0116b30523219de30bd972080744e9cb75216501aab359ccbca5485eb8f022ec51b0a43dae0ae5901b1ef3ce60443b07541

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf6f13fbd9107462ecca729852c9e212

SHA1
af92e064cfab27521040c72db5668231e736d959

SHA256
fc0ee004b1afb54693baa1ca836c9f982fb44ca7face1e76f217d7af176c105c

SHA512
130046c424398e0ed5ebf04ca6242fbfe3728e5bca7da9984d887d56af5783c09d7b1a572c776c50e7fec1382ae3ef890d98e9ba8649375ad3e38b4dbf8821b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3acade93cab6413e37a0ab48972f021d

SHA1
26a49e5a4d5f9ca34f9e76db970cbba419043a53

SHA256
c853ed0dfd4c07af9b7f2e9b270a7bf0eba64ed70e974e9c8a67120b1790bef0

SHA512
b2ad4fe15bc08831e1e775158ef2b3a9a08f9295d85082fea2b05a143ccde0c56d01df5817fef77f3fbfaa7144be215a103c0820bac27b2c69c9bac22c33af8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c90635f2e3b8cf4be76ca379139ae21

SHA1
1580034e7a8e7185436519aabc8d9119bc9e14f0

SHA256
f06911f9c86e8be7ad7254deb72513da9ddfbd90a103608ca29f658cf372a4f3

SHA512
3902080088bc93a6f4363610fcc15de891a4f9ba0015f4c61711ff64c25d8dfe8335c6a7c671120c21e378466c0fe560f59de46e88a3cf535d8cdd65dfd89e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d70d2a3cd169fa74e87d216e5b811a64

SHA1
caedcba8c74d827e5033d269c1ac36c37acfda6d

SHA256
1f4b4004b9084004f6d0b247fc447dfd1b7e5cce06e622e85c7fc0c2d4bfb168

SHA512
fb43760a6917c3500d782a215a15c433b2f6fabfbd5d24274adb93016eda380f739b18ae98773c4fba486f7551539c7d40e2333bf5cae812e0282e2e7cab844d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4d1088cbb65b904553b85f0ecda3281

SHA1
0ebdf573652d1666b86d925d7aadab7d8c89dbf9

SHA256
66558b1a0a47b5a6258485292ae77ce6ee7f5923a9155776c42bb05808e06976

SHA512
0d3fc6132a91b9582a6e38ceca16dd8fa88cf39ce4ac53ad74267ad97b59f89ef01ae0fb796df8921ce75cf52f658f41212b174a496182be0672e02886a66859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab9172299fbb200b7730968ef5a1370

SHA1
ee918b294caf708fedf33000d5a01e5d4c61c646

SHA256
597907e893d44c4417412897e41416f5e4e6b67069dcb15096baa2ed4f5ab6d6

SHA512
0f6c3f053fb8cdfdc08bc3e89ea56b5b347d0e4a5952618072aefe093ff20119cd5e2c869b8202aed1aa0d96c5164323673dac6c3742fc7a07e53bed141d5fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c740c0ef3de02d413ab422e88c444f2

SHA1
d2691cb22e73da05dc5b39c6905c338231b6fd91

SHA256
d516f0549c58076c326f369fd4a9988a63db03a100decca21a2d3cfce471b4f6

SHA512
0851336344c153e66d71fa4bed9df4201f253efd8c9176669cae361a95da57535ce72f79f9ada10fd73f107e09c561472503756b1062e0f91773a75926fdcf55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51530a166d72c1e58ae6aa3f42d5f88f

SHA1
3f8bc3dc50d06c7528f41386958ef35a92021b10

SHA256
b249e48d96eb91aa972eb2a3c6633b2927f2e210d3fa465ee3a4eea7f511f37a

SHA512
fe1cccf383b402f3aaeb8737e98adfd571c2696190944a4ba9c830d18c04176083b02b523b232bbcf9c7d038eb2da5d7d73d6359267a5eda2553d05405c35d8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\lenskiyteamoff[1].htm

Filesize
169B

MD5
84855c13836b389d5ec7cfd4c9266173

SHA1
1cf3056ff23c4176fd7ca9816a000ed461d6d323

SHA256
502083c916ae481cdd413b8d93315300653df5fb3dcc5770c01991de19977eae

SHA512
2479112004884d42d4ffe1174dc358c5d1b0fa2b41641d32f2fb67539c4f834d63cfbbf7e98c63b9a64e49b26390c410bb7e50f1ad4a755f32d081367af05fcb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\14564

Filesize
10KB

MD5
527f85ce033c92de20371e78ef24550e

SHA1
d9ce081e8a2863b3b8747d2445219764c4a04ebe

SHA256
4910a9e4525ec6179f221f30aaf7b8684d93c6912b16d5fa72ba9ef4ba84de76

SHA512
654708687a0aa3e9841fe7f47c1a358b5ac4dbbe27752e19f242db2339c2621a4f9f79e95c3579cbe6100c9c691483438c09a4de5d11e0435eff9b82b1fe4783

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\15125

Filesize
17KB

MD5
e9319ef76def1389b95e88d73f4a2b85

SHA1
6cc8560a43c45398af757daaebe9ec6fce9c5d01

SHA256
9aedb8284aca61c37b4eb15c44b26e8da5812b057a739496fb4becce42a60af7

SHA512
57d33149964fde2c48b4508446322dc19cc83dc8083e36bab43e884fc5b2c5ac7ed711d3a69d568faa53ebf5e3d87c744d83bea5b9ebe9e2599d01535796b6bc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\17048

Filesize
17KB

MD5
0d9916125b088113eb2a940330e58d6e

SHA1
9558027fae9433b21da59beb53d2302991c67762

SHA256
225d4aea64723c7ec96133f673b5e8e288a9e7726cb901b669d4f6634dda6dc5

SHA512
1f443fc450b4eebf57d496abaa39d201b754d9e13cd67bee5bdc99d9ac8ce962369f15bdf03f87e6fd7acf057e16e4bb68d3fab65abb5f1c4dd84c1f2d93e9ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\18068

Filesize
17KB

MD5
e9c8afd6ca97512c6e80cf46c99cb209

SHA1
b4461cc84f27cc8f0975bff9a3328f268e7449a1

SHA256
ae2664fd19f15b776672fea38e6d8e1a1ad33d2b78191b2bab036978a5317e08

SHA512
adc50d50cfea2f3c96d641c2f277fb97e4fbc6d6be4c1d331fc2dd43ff8cf8bc3cf521a3ba2ee1da3caa2b0b6b86845c4345a22b313504eb4aaf9fccd75e5e90

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\18389

Filesize
12KB

MD5
cebe9ff2d81dd43064c62baa27225c2b

SHA1
4ccab414fcd9a0af0479e17a86c218fa7373fce3

SHA256
65eb6dc490e4df17ecc568b17d3f5e72c0ad9d9a3a4214a598e1774ef654db38

SHA512
3aa1af99a7309d4d674592e63f392167797e2d0e49a94bf0caa7de1f1206e4f50f6b391451f98a07afbcd86bd5a06e648d3c047be14d9e567e3020c5c7ee24f1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\19528

Filesize
13KB

MD5
37945a6ab58785371cb839fd44ca6764

SHA1
a571013d90a04560759c52b22fa4e085d5c94471

SHA256
ab6d362d154a441c44a56134985dbfd6fd5ba66122a8ec5e7e09180c0fad896a

SHA512
bdce289794cd7964e9e1d0bdab967c976e557685de53fef57c83a1e650b598dae33791f3d2da4d1f76ca9c3b78943354a9ec3b20e118cad5558ffc930be9ff35

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\20020

Filesize
14KB

MD5
f9aa8128cc5c01a1baecc26675fa8754

SHA1
70170420bb3d34e048bbf3689ea1971029db7dbe

SHA256
cabdeede33448d66badcefea0552cd022d4196989446f8b478498215ac3aaff1

SHA512
d9af15242301c94ce00528169d61d5a7f07819188364eb0a5965930f763fccff1b72b078921cc67dfb90c4feb55bb3845c3ac74dfe3adf72c8b4078c4324a2f0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\22227

Filesize
85KB

MD5
366cf7806b894babb958431412a4d35f

SHA1
dc49a2ef1fa8ee593dd5d06ac31f8f70b7613831

SHA256
546844d83cc707081350d5ce9cf092b37842411b7f2352af654ba007a26ca8a2

SHA512
c7362eeba382d8fd4aa1b457a3d74526faa3f806ec3147e7d6d6ec8939626639bc7a22b3c219f359d6d745087450359c52e0c7ad3eda8d463a1f9bb42469790f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\2241

Filesize
10KB

MD5
002505b53bacc333e69a8d8d03dcdb20

SHA1
9b7fa27d8de3827e8cf1cf0b68f3697f37c7d1f8

SHA256
180b17567fea4b20722afba0a7e9bc0dc7d6f0d0e58ebc957177f0615892e4d1

SHA512
720a179b7ca6a10e2915cf845b18b6f4c6fa1e24d8fd927da0a0e0f97e380e0846be6c218408f27668114a6e1161692ea1bade49b0361b232420c5f4655175fc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\2636

Filesize
9KB

MD5
3b0229a6930a143d4cacc1dd2a892f4e

SHA1
97e2f08d32a51de508753898a02d74827214c26f

SHA256
6206f8cca1ff7f5f632f54b927d3f73ed218f6fc60597890f0f9051a13fc1d15

SHA512
768dafa41f31a8f8bd2248fcf452c8263fd0c01aff97095ca9fc7077a6ee9fcec2da81094263e882a80a91fab1cada8218a0c38696879f30be6be7111d1dfc75

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\28041

Filesize
21KB

MD5
009dc7693f94006ea6d3f6acdef2c322

SHA1
9653b2de8d2efdd7aec035d34cabfab0e955d877

SHA256
a63bc3941946a31dcc27883f57bb3bb9af2049dc95885a4ce2f5f245fece28da

SHA512
d7ca22fd466706ff8352ae13a48fd36e6a8bd887bc7d007212b002896629d5f68ba2411e2e9297679ca49c9229ff3e3487dbb2b9de014e6c8e4604d0e6085e60

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\30453

Filesize
85KB

MD5
538554b274b36c31467f7dc683cfe4c0

SHA1
9009645823fb2889d9cd00831a43c95f1c13a2bc

SHA256
9f4a61ada6dcb3af3666eca08a22fab4cba1a80c90adad26af524036e21df9d9

SHA512
f6380aba5cec91cd324fcec92e090eaf85c1fac9bc40e861e42c6a1ef35c8bd86940c94564e3c5fa26f69614c21c2689caa01fd3d1c9aa56586d5f0674e0150b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\31881

Filesize
14KB

MD5
0b3df2a65171d1efb8f9194452364126

SHA1
93fe274594883fd5a8fd11a826e0b850b85feb2f

SHA256
f0fbb204d7f7446ce48a668e7adfa9575547d6d3bc331fe3e68486b8985039fa

SHA512
44cd1e9168d3430ace8c0e18c9dc05a2cc8032e618b6fd2d6bb32692fe3e9afc148a645f64e869fb7fa612e1a8a9a1d975d13ed530f11e49053316b187709b1f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\32533

Filesize
14KB

MD5
e9fb5ded80af4e257c15bf4a4193ef36

SHA1
8fdb832dca7becf479728692b77499efc4ddafd1

SHA256
44bb7facbbf5b799db5943b76b86221ed2918d2f4c44c6da76a1912ceec9fb91

SHA512
23f0886e485b91ead250803a2b38620dd679220d01a98e75ca3edcdd365feb51a849c8a209a5e47746b65f112fcbcfdb0d27217159a59a3d0a5960f5ef1af252

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\3723

Filesize
5KB

MD5
7026ea9c0a1e44f872e218e5833259bc

SHA1
96d3c51464ae97efd22fe6ea911a81110c0f867f

SHA256
e41b154a274f53e51d2e192702d51861290fda4a29e9e5878ecf9ebbbc9abf36

SHA512
39d555560323ffac84ffcf26d8820862ef66b4ed39a4a1dc0c8ffb5020933107775d15765c4893c3307ec9a3132f9d7339d01a8c7a24930fd329065f27c0ff09

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\5273

Filesize
9KB

MD5
1237ed826a910b162e942914b554813e

SHA1
dcc9fea6c3dbc0ed11d3a26e91e75392ee735760

SHA256
8958e09bd18a3a1c1b8dd73b7672be49a88cb9f7272d3241f4a89947282bb4bb

SHA512
443e7e6efe6c4d4e797cbe8d8a4a57c10f7e8ebf37b72eadb1d3f183c46537bfe6fcddc5c14a87b4c9088a71709f4b1f837e1664124cebbbfe1ade13fe9f74a5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\5565

Filesize
15KB

MD5
d47d918adcbeb3d5e768750a96c8d48a

SHA1
6493a3a10b89606562a87735d0cf5b490adf663e

SHA256
af78b53281920873690a62c5191a32d41c1561b46ff1323650bda1f900b7e28a

SHA512
079d1ca34ceb8c6542b32f77e04c7d9ab7ef9a4e1b3994046b154cbf783b4bf847dbe2ae35b1ce27d2873e7da3d2774c389df6f5c8c2816c5c4c8642314e7a66

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\7022

Filesize
8KB

MD5
2228177829a1de2b81338b91f1508b7a

SHA1
5e547b00ed5140127731d54840e9f471ab1a5078

SHA256
891eabe497d0e71d154f3794140b6b2c158877221e9dafc75e81b08c47d0304f

SHA512
42690879211890bbdfab3260c3732f7a814ed62dbbc266cbc5ef9fc3810965da2b4453ce531aa2968849a6c4904c7777b74c0004ebb04682912b45955f2e1062

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\716

Filesize
13KB

MD5
e644eab98376bef33821039702a18bd7

SHA1
8b0e65fd2efc6694ca82281fd189b13bb8bf0019

SHA256
fc355fef53b5b7c8d0c1d6d7d0708ecee1b47674b80b6f16ad202a5614445020

SHA512
0b4da71558eac03b957a3649b2fb001bf60f6e0892d5e618f4b941141783d8c23d41ae0c62cd17b4ceb82acce81bca1622c6ea96e3a10ac6d58628a49dc27978

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\7373

Filesize
13KB

MD5
52ef04c046c167595f01a1d42e4e8e60

SHA1
b344d2575175e795f2609c7c0be3243f738ef309

SHA256
674a282de776d77ba9da948c114183f860bb3809bf5857acf486d63bf7878e9e

SHA512
c0825f02a320b322a66760af1819fa69d82734edc889f3aabca5cf6859c8e272645f0c6cf8a71f3a33d7204edc2d80a1b46c4f1e87fc59d2a4ea3e3a24c1341a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\7695

Filesize
21KB

MD5
82ab73318b11e9dd7967590b5c7afebd

SHA1
4db7c454c4b708abcec2573cf83f2250f2d967e5

SHA256
9e76d1c357100fde938dd17c89977025f4aad623d694d3c1d76edfda65f3e883

SHA512
9065339b0ed45c68f1a31ed39546507f01a9eee08c006762902067acc3d03f2e67c018fd053beb3eb904400c6e47a24fcdff7884396a51f72c0ac30e8fcc0596

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\8236

Filesize
9KB

MD5
c4d1a241cfb5c36e90f37460f1ce176a

SHA1
8b66e7cee805650191618eead5c3623502b9e994

SHA256
dc3f86c065595de2cdd1407d359a36fda27aa846c2470338d381caa056268c51

SHA512
1c415d2efc678d2b860f32aa9c60e0322677779f3b2b2bf2361c5996f31a91816170d65af9d1554e29f6dae1c4010bca2a8d66691ddf95208a5e29fb0833d8fe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\doomed\8594

Filesize
16KB

MD5
a4949cc57a9bae091d6014114678275c

SHA1
07733a860275e1bc5617d68b2fedc9bb2eb6ffcc

SHA256
68d4f8102dafb818ccb472f086fcad295d541e4b8415a11c3288edc1434f1bff

SHA512
9ce36097b15e5c878376489e74e125f2f8060982d5aa58de9e04458a71871bc306f2edab3b43fe6bf8dc5484a09ba6ee7ed30cb1d0be03cf9e9d3f34ab7a90f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\059B74E134E66B6E1FD6ACA988F4D6A74AA16024

Filesize
29KB

MD5
c341de585152aede90ceaf56a07b5bcb

SHA1
29c45b037775242d70f2733a92fd7e1814ee0512

SHA256
82528b10aae6ed5044071c7525b0cac85b570d764087ec01e39f0e6fac090888

SHA512
7bab9bed55090b4809125db971614b38b0e9651f02819640e24475dc999fe373ac57258a5d8f43d91ab3b0642c8e1cd9239bb9a829be117d4d52e0a6e43027ab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\0D0BB73C78ADDE449FA633D84DF95E410284A76D

Filesize
14KB

MD5
de9daaf083b87c09fa2d0967132667ca

SHA1
8a71e2ba282570de71d74a65262c6b7d5d405fab

SHA256
a489c0be159cfbe4622ccbf0acd47977f099a8e628a8c43ee67b83ce4618a7ca

SHA512
a145ad3bcb5ed4a390720439935c711e3987516294f84b8f8d68fde14992657e7b7e1cc4fe1d25a0daf7c402589a26c4d0ab381c60e52411f9e425fdca039113

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\22951A48DC3EEAFE0FD2C63F74E71B4BF9299ED3

Filesize
21KB

MD5
f2c8a60ba7961f462751a1733d6337fb

SHA1
47da01835227162300cb60946bf19bfa7e92577f

SHA256
d2f32a68e13cbf8ce621c622e452f26818c2189029563c3d742ef26545a8fac7

SHA512
1cab4e2083c91b6668ecd3271ff8ee8b12bb49d9019348929eddb4f4533432c18e7b8b1ee724271a860dfd5d663556c2caddb215ebb6012e60f7d87109c968eb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\40E61FC4A12A52833E0E44BFE9BC5020C5AE9C3E

Filesize
33KB

MD5
9cdb747d9e419ade7862c3df7a345de4

SHA1
0e0d3d42d6b03949373e40b3cd1bdbd14a6d857e

SHA256
7a659eb34633ed88710b6b9903cff1b05e0701c59e0ce66a73e6f7f86b3da9a6

SHA512
bea5f8f5a17feb1acf77fc90da06f492489c1fcd20d783c9603709c6a0e5c127cff5a9a85699456a915539bd6486849c027ed0cec4d6fe1239baf5bf570624e0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\42247F1D06B3B06A22AE49553A51E0F133209144

Filesize
703KB

MD5
11906e12620dd0d954779f5047981d14

SHA1
4cb507b102e44997c99d2f1757d2fc2bc74e0051

SHA256
6e1cd6e7edd44111cef82fb7ad07853576766f296a9159bcb8643b5385256ccd

SHA512
0c3bba83b7f0e1fe0f843a2955baeab91e0633580826d706173e2fec564a357dd335b4576e3632fd0c5873a676c1f68d28ced369b0ac37f42d0c025bcce5bc99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\45111E44048F8782EEC73F44358197AFACABE6A0

Filesize
17KB

MD5
32596221c40d827483608c738b46889e

SHA1
db9c417db310d591bddcbd5475fd70824e4790b0

SHA256
dc13e89231571e03f129609d4425e7e312fef2f5031b83889df20dc191d76eda

SHA512
b7fb1f6edbfa4bc76e6c88f20c119cb698f0f4ab3233873b07e0b3c6dc40273c4e5e1a873df794b2544c75a0501b76579c9b17ec1978f72de8cbd8c5aec6429c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\541C1324BD18850A5199E21674F28C0BE65E0EFB

Filesize
18KB

MD5
4c1a40bf1b181caa81ac89f5b7a55511

SHA1
8b10cce251fe347b4a40c1a5b0a373614bf1149d

SHA256
6ffec251a925113788b2363c08f3e62844ed37756c6febf2ddb241aba418a0a8

SHA512
0d473b01699edef9e098ffb36247e87c967a0e30717f5bd0d27a10b5860caab0c0e484fd6623690bbbec411bae5f3bbab06157bee4260609f87df34a61f02283

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\5F4015B87CB7B32B12054BFCA576D99D315D1266

Filesize
25KB

MD5
594831c44ed8739d61ab100b3e4c53ad

SHA1
0a52860c95679b866b599a297411e52e1667c587

SHA256
06132ec63d4686a55b7c295bd11266b021cc5e8379e84d260997245384d4481a

SHA512
9cd12dc03a1aaad8654ae01cf32cf53feb49d057b5266c31a9030f65ae6fe6dfb4b232fcf8e22d16a7b2d7d00841c657a65bd00f9bbb8a09eb70fcca20fd8c3a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\69C85B5310A2628963FF16C33CDDE1E8257D6A99

Filesize
114KB

MD5
626865c81f21ad0768446d139c615bbd

SHA1
a961df7dcb995d09f7fc52ffaa4b1176971135f2

SHA256
236888a293a66f391ebac8dd0e4f717e478b3102d9c0573533662b7496c8185d

SHA512
c1f2ff1ee4d7f5965811cf086321f0ed394f69f2df86b5335ca5bbf51cb37fa2f74baf813dea9725dc557dccf89b272a06ac7f604fd79072d2dd7075ade95abc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\8521477D88B73D5232E654EB56FF3BFFBA5F8043

Filesize
17KB

MD5
4e559fd69d17cd23acf66e0158b8f2a8

SHA1
68ac20891a0894936c713435ea67e30fab524712

SHA256
b629262eb6fefbeded123a1b9197fa59daa1c6623d46dfa3f7cb522ce49d2321

SHA512
009230654a3a685f53117225ad0d2d271f3fa3e6f945bdd871c647c32cbb12a759b96dc9571aa6cc1cb495dc97eca275039c9b8ff5fa339cedd93272340317e1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\9BD2BC3EB5BA4402815048DDC6DD6747B2915A64

Filesize
74KB

MD5
68adcf0b3856f8e63e7284980c9b3ff5

SHA1
05f1fae4d6f560d05825c3ca0f47ca582c3af19f

SHA256
5325b698c65f19e218034240916f3f5fa24ddf5d307485b80e56a9537213b0e3

SHA512
3869be9e27a48c2d7aabcc581bc9183642fb9aa96b8391e6eadee0581d76db7e4b1d4e79da66e5aab07e4e263937d0dc1da506a5b3f42028d4f782a7f1e19fd6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\B9322145C9F9A9EA09ADDAA5BB0D2A0CA17C49C4

Filesize
15KB

MD5
ef700aa0ebc87a34a78d8735643f7fb9

SHA1
7cfef9897088e5a43913ddb0eb9cc4bef524ae56

SHA256
f3a8ad2a8e922582aa1c76657d62e59c5b2bf4a4d8e1dde5e19bb29174408adc

SHA512
637182c4fc06915b26feb170d1c2809c2b840863d8143694a7f3b3bb80f87c48993b31a1d8d214ed37a6c1c8b408d9a27d0d21c952930ead8fa8aa399a818f80

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ifb4waqr.default-release\cache2\entries\CD1C072D54BDCA9741379CFAAAF23DCB05EA35C5

Filesize
154KB

MD5
6168c01f821710449b20016d549416ab

SHA1
3f716ee9aaf65a9b4860971a691dcac4746d4e31

SHA256
932d92e6fb7eda3a634b2e1ad17e160fb65ef28b229efb591ce4cd31f331dfc8

SHA512
feb786ebf970e63c1a33e06236eff426fc3102c4610511cb4420633bd340bea1d8af8038a8d47efb7804a4c6602a6d55e572b84bebee1b5b94f589c67eaebcdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\883rzijmqBEn.bat

Filesize
210B

MD5
24007b860028e41b39fb2460189118e3

SHA1
f2b7e0d3e057d83617b4609dd8371a625afe2c20

SHA256
086973497fdec148dc91613fd4bb2e855b592bfdbbf93237313967c74ef02eab

SHA512
0b9bff2fb570c0df1e7bc8e4dffdce7ac383c49195142c9ef94aad41807138b435c85d6add67646f185d749eb5093e85b382de39f53c14f65651cf5db6c7c03a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CLsaCBl2LGDG.bat

Filesize
210B

MD5
983a841ba6757477125b5a7286432a78

SHA1
6888904086da13db13440ee57b1e6cdfc9af54f3

SHA256
4859bd1b93dc799c1011d4845caf9d5d33714f1213c472ab786077b6c8a6b2ae

SHA512
168d5bf10a301c0e09020b6a69e7f93cf87ca6237cfa1c9319d937a9983699416599ae8ac10589271fe3d00440b7d94d72dc54ce07d1dcfca8f07f03d2580377

Download Submit
C:\Users\Admin\AppData\Local\Temp\D0PsREhwK3H9.bat

Filesize
210B

MD5
4ae33956eb6fd77ddcd9c49c17780185

SHA1
439d9f608ca558aa924ebcee38088865f3c5bcec

SHA256
351004ca511ecd1d6ae34339464d5b93908be8601bd8b0bcdd39b34d0770853c

SHA512
f4d045dfbfe6dc13ea5efa147142265c68ae956dd9fac4b4449fda068daf7455a2e529aaefbba260f8a750a314dda079e5f484db3780b58d145b57095895c9d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\F3EeBou2U3PI.bat

Filesize
210B

MD5
8b3aeb0e4ca9cd08905dab0df38c99f3

SHA1
f3391322ac9fa7cda4a65753418aa9b1483a3832

SHA256
4ac9b223612f766098dd847c84e7f020115f45b880cd109d73738651399da0ee

SHA512
4d8c397f9b04352cff2fbeadfd6ef03327999fe1e655bec882708df4d4069522ba045cceca96f89c2d7e6796b33fe5ee8ba2682b75581da576d7c85fcb688a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\GsPS5gpIDJRy.bat

Filesize
210B

MD5
e5deedb64cd82bbf297833edb5f9590b

SHA1
822645642184b821e10b867c51890e5c3d6e102b

SHA256
e621afd82359a3da184b94cb3a8d41db7e8d9bd9bbfafd2db10b1b3569e5db3e

SHA512
b0caa3b8d4346fa2f8d21c14cdcb9e3a92853614dc6b0086266d7c7e87caba4e98c3d24000fae9b156c0ca12b02876232046e1996ee08405078a6d3061262a34

Download Submit
C:\Users\Admin\AppData\Local\Temp\HodJUghRCI3a.bat

Filesize
210B

MD5
231009adf83b130a0a6cc8c9b1370373

SHA1
bb0ec1ed3bec98ec30344da71acebd08baece228

SHA256
eaedd7b65c7233d8a532e51d831b6341f7a3de59269c7b3b3bfa49cd51438e10

SHA512
fabc449d85b5e4f5653e48f3d12b3cb3ac4e4fef164a22f252e08a62b636228b4a490028f732b46df310abce648308b34ac7627e1ec502a934e232c14b477008

Download Submit
C:\Users\Admin\AppData\Local\Temp\NjDjZ34CyBqR.bat

Filesize
210B

MD5
20b4119149ed0c7ef5e659583a692139

SHA1
374573ba714331289401581cf661ca872fc3dec2

SHA256
e6e79b533e4ec45b3f79c3eb4c64f983a0366e11371242659d6e9a9f465e0543

SHA512
88dd3a5003b53d56efbd6b4d36abbb9bc351774b2394e8183194f98a0141173178dac1555f92e9acb727acb371ee8f5b088b7afa490d53de64dc4cbe04ec2e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\PaLMLYgXoFaY.bat

Filesize
210B

MD5
983293a7a01508ce1d2cccec74ee8d36

SHA1
16f18add314932f3b0e40d55c6a875f11a772fcb

SHA256
006ccd1c99ada2e6d31476d8cb65900b031158af255130eec095b52a8eab4890

SHA512
735cf3605b7bbabb5b390970d6f480df417fc6d6e253a9b8e8c2a22dc69a955ee42a9d50e28739e9a25d570a16fd4acc628f60cbd13ad9542e987735e171ad37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qp56ctuhheQq.bat

Filesize
210B

MD5
eb95c39383edd5de533568aa1089adc2

SHA1
d55de28a7f294c490183fb1a76fe41d6e79d4ce0

SHA256
79fd84287c6e1b7aa8d3d9df2734d1afa51526db4351c91b92b0271a9393f14e

SHA512
aca5387d7f77c78331939dd40334160f8491b557da02ab9c702bddb1dd91d83a367475e3088433b8da238106e8ea52decaff5749af29298eae16c4b3f54282ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\S2U99vEps12D.bat

Filesize
210B

MD5
238ecdb3db089658a7a3140d4c33f236

SHA1
ce9167069acb6c7c8787244dcb4cd51e25661840

SHA256
879d91b69452b9dbd72fab72ec836cf9ec27bf55240578687145b530541b087a

SHA512
b2d895fa16a66e8c8af6488e83ccbfb05a46e8e2b65f7815047b19928cdbcae725b6223ab4b8c0fc5aab9b8dd2fc4e69d76a3d66d308cd25047df6bcdae96397

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D55.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\UHgBUVJdsO9H.bat

Filesize
210B

MD5
88413a366f1e217520788523493dae52

SHA1
2747cc6fa5c132aabfd438f9a4c801afe5835241

SHA256
36d3a8b3cf2e0375280dc2bb2dd005788d3db8227e9f0e497d8e40066308e0f6

SHA512
9f696bb8a23c4557aab1d5dd08135fd8abfaf20b179afd1377cc761b8eeff7c1628e3c1277eac8e918bebb04752c7a6b80db61548f9fc415da6342bdf5d3f1a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\bG9BVYz1pCja.bat

Filesize
210B

MD5
e715b27fe57e75bef74f300680db2f53

SHA1
677543b6d64938a45ea7900f9b204e7358c8b454

SHA256
9fcdef4198e964dfb9c2d3344b661cb5b4f927b5fd07f93606cb42e09145c3db

SHA512
1dcdba59131789c32c7862a1fc06cc33facabfcc6a81ac2dbf1693ab9f9edd305e4ccd09f83d34d3faa8a2e14345d6d4efa30282eaf317277710aa3df88d21d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\bccuGV37pPei.bat

Filesize
210B

MD5
b41d018fe9691b84ae71dcd2e0060ffb

SHA1
a09427baa9e932b493c2f6e7393bbc3b8b6f6975

SHA256
3f46e86ad365cbad981ae5c83d8a9f9d4ddf197d5d1b5a6ba7c9d09ab9626735

SHA512
593bc95d78714f35e984c9c0acd52ea06fe1b815a73a8f40964364d5559f7f800614083cc11804d1b58b7d2a4db58b2c592c7c578b6dc7cadd18bdd704991982

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctITPSzLobCS.bat

Filesize
210B

MD5
d867fa9c24994da5f85a7417cdbbaa79

SHA1
2162ab4c53a6c8324be26c81f40428564db1a5a8

SHA256
30a4b0ed1b39e6367af6827afc5206c21df51c4dcb5ae3698837d4e81f6afb50

SHA512
defca055b187ef843c0b4df58ca3b2bf847db16a6fedd4a355b045879a1898028beae56835feb41977b5eaaeec21520eaa4a9f70829d2ecabda878beb24e020b

Download Submit
C:\Users\Admin\AppData\Local\Temp\fRbRx88h4TNH.bat

Filesize
210B

MD5
a5aac87b320456258bccf6c2f54aee9a

SHA1
c2a2d6b5e423e4367ac29841e9ea5fa7e4844034

SHA256
d4db0fab206530db7caa2a8355a4a02952e59ae362ea35f9db2478bc672dc685

SHA512
f8dcaa21f807427c940ecf9d7d747774d3a05093f61adee451c25e9359ded6f180bbe80347f2a363279c84e1c33fababb6fe43122fd4ec53cbbd7467bd4a2f58

Download Submit
C:\Users\Admin\AppData\Local\Temp\m6iaTQlpWPPi.bat

Filesize
210B

MD5
330a6d0024390943df5fd8484b249650

SHA1
655fea3eaa23c3deee8df0ce0606875e517d416e

SHA256
415a0033731cc979c80786ae4b116e33592f8ac7cc58273c970e6328b9721e10

SHA512
e66869b8c925b3219c9bcb474f94f75ab4197fa22d5fe3db7d6191b105fc3f3b766e60f82f93a1d6ae90893ca5376498b3c0da78056ac7d30117a9b274df1846

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\tzXutd3VvTFR.bat

Filesize
210B

MD5
129bdb22bca34dba06759c79bb6db5aa

SHA1
666d63835bf33fbe0bd4cb11347d810919112abe

SHA256
b74cbfcb1bfcf3a93076e7aad9fae19dfbf88318061120f85247396c23d720a7

SHA512
4d8e42e4994bf3afd9a8b667721b0e9974a4db0958ca7d1f539a5b68fbd9da032e1eff436c7311010c6b566c4a3d9ebe2745bb628decd6c431fc97b3dba81c3b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
f95371de1d990493bc97b28f0d648391

SHA1
d43aac0b11907bf05d96aafac4b0f594b21a54da

SHA256
a17a6d83712e9b5876acbe78b09aa7e32578565a4ddcd0a8b7494af2254a8714

SHA512
da8e7ca3e86539a2d356614c8a4cc8415b0ff7db78d39a62157630a92cb76e6fb1c6d48ae33a37f1962218f1bc7257aaae27319d9f9fe09efc440d2b0e280782

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\datareporting\glean\pending_pings\1f3a322e-df48-47b7-8321-eac2e84e90a7

Filesize
11KB

MD5
d61b0b6634d8e541464b7b9be7a125f5

SHA1
c66eb7982ae4d23769f0a839ced309b248e072aa

SHA256
c5a292d4b2182e79b1e29b3d61b171ec1aa052f068bbeed3f57641b7371b58f4

SHA512
f84643cdd4b637288d33c09e8cad306626bdbec3f84d11bb65935225d6aa32d606fcd5708c61ede8c0171d37a6973d19f47d66fcc9a54689d14ae175a8f8b91c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\datareporting\glean\pending_pings\2fb320f8-9750-4102-8e72-df61d96d7977

Filesize
745B

MD5
2310c6c3a45f8afe968dfedf109ba756

SHA1
316e3729af6405cbed3d597045fc765de4ddd587

SHA256
7a2274aafb38643fbd0a959fb368b316c52c6c3f81e39d72460efc000da77381

SHA512
d01f391b6d8681dd04ff4c278d9af326d36ff71969701c44d60be7fe4228b1246f662565dca4768136ee6213f250b50800f6e6f836a9b5a5d18da0bd800aea63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\prefs-1.js

Filesize
7KB

MD5
2db4c256ba5d853589ede1be2067ef0c

SHA1
a0ce07626f2fd70353b5e8fad0899a1c2a757641

SHA256
4fa02775032b6c4beafd61e65c1466b9a3f507e4eb7c5a3d14ad7ed1ce1b9d61

SHA512
26ca2a7539918d86112d566b911293a0f8875205002f377953ae4c39e1b8bd12a0ec95771af183ec614636e88307b261bb93d2a64e87a1f355fc5971793b2904

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\prefs-1.js

Filesize
6KB

MD5
e4cddc25a59add59202ef64d6ea5f616

SHA1
751f6ad62e143223f69b745805769a95ab6df61d

SHA256
e92fef01ef0eb5a8c5bdbf831f8d1883b3aae05bc00ccda0926d2ce5e946de59

SHA512
46d6bfc7fb6dc6c8c8790a261c473707671f3f2f2ca800c9f72a51a5b893bf5d5474aee8bfb05819021470c406e01e70f2292198fdeaadf6955df769fc15149e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\prefs-1.js

Filesize
6KB

MD5
d510cdb905dcc057055318c76e2094aa

SHA1
5837309cb852b9208b6852d15165c5336018de92

SHA256
c4d38be6ee924da0790f48ce7ca58738e8c9041ad8c593235ad854e8c064a2c5

SHA512
03384bc037ee92df6dfb3b126ac58de3b96ffd2c3241c387e2a20f55665ed6903afa4eaa7e0812d28500ae49327eb907d89ad05b44810f4d1d67e242b5d7c41a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
902e379b27d9eec6e5f2b480e807fd38

SHA1
87b90240a4bd6fd4060d34139a6ec88ba6647a45

SHA256
29265233b0d80e870b5e644efb1cb9355c618ea9496cf7efd75720a6b8f3914e

SHA512
086ed8b3b09856899a7e1e7aa965a2bca0779544e0faff13bdcc5ba68bcc986de7d6553ab0a8709689ad8a99475f99e764dc98f4289191018a3a8874cb0178ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
1214c6f086e7eb1eb0d9988c7bcc8749

SHA1
585f555777b7cbe4b5c155aa91674b48552964bd

SHA256
ccd10720514c653b98c9cfe4ab68a8410937ac26718c9d1fa89ebe9d3e495da1

SHA512
bf90185d4f187a876b172b23a39fd287d5e547f5ff6abf4fe3cb7467dd69c4f62b228364216021251fb0b5b4379f9cc22c351ddb924be0af0ed2f96c0be3bef2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
a2f2fe1de539e2f43c88723aabc39c04

SHA1
46340a779d965b19d6f883f246c9038557fbfa7e

SHA256
b3a41d39cf8cc4960f2ed1565301c839d78c6b4d5d50b6c95f26187f5f484fd6

SHA512
baf325bb8838e13bce9298ded5e59168c3f7aaf9f98a7a15eab9e667356d7dc4323e7086d7f5cf6bd3998693058dc4de23eb938b8dcfba9fc26e09c2ca3cb69a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
3c056f902f7f028e99c1486db6aa148c

SHA1
27e2dcf0d32ce58530d38e7546721ac490084802

SHA256
5dcdb160c9fe1a8c68421adea239e20fe56f92ffe1e43e0c44fdc3b465ba33a3

SHA512
f37bd3197584c0a6778ab08d26d3fec00f57e02330995f76db9fa6e0db0e6b249ed9ca6a5d36199638f42339748231624029b0061e18e609c5025b7ae752e2d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
ee73052fdb477144a6912df95dd5ea54

SHA1
dfce43e4310b13f82415a22395b0b2e40aa7779f

SHA256
e8fa7fdf9e6e4384086e9fbf6cfa7770d6d1e440c0736d7dc782cc3617531bbb

SHA512
42956a25d8dd0668431e9304d54b87e5e43410fe6de7aedcbdd0271eae0a84210dff0d4cb88ac1872fe46e5a922caf0e477c67eb35557069c98b110b036b1a92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
9541f6a9716c176285f87bc8b6c0606e

SHA1
788e0231674845e5a445a4189b82a0e1dc54e21b

SHA256
6fbea13bee2764e82b1b4839d41303307f453fe255c1fd8d508db326556ac94a

SHA512
ab718efedbbbdd0b058135426906ee8d91266c756c475c7f064fba0af90da7005f77191f924e6467fb2a4d565e089ff8a51068b715da8ed6c379f33d237598aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
8d691975bc9e9d660732783564291082

SHA1
d1439dce8aa584b3e3dfc4ffa69bbd78c1d3408f

SHA256
977ec464503f31e89772e0810240897c1c67661a3f3562613a11178e59e23d0d

SHA512
7c6c6008e0dc79e679e5b45a26fbd60c2b9c4c508f33b7c7f8c234a9132dccdd9eaac02e87a87f79dfd1574e41149896d8befb066e726fb21059559ff1a9c9dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
81bd9b209b454ebd59d22e14767e298b

SHA1
839724bb273b9a2bcca2c520de41d22c212326d5

SHA256
c13106c473ed0533f52a3cc5de5bd44862933fcdf9d9a8f063579288104fdfbc

SHA512
50428f5c67e0b9a500da13f159fbc49e6f021d5945336026093cc0a1da82fefa9031e1fc4467548a6f3bc7014f5768db3dd8a8fd90ca527b885ed5b743c68524

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
97d6efd9c57b651ca56955914d0cc536

SHA1
2136a7631536f5b8c478995d0213b3e433f5b0dc

SHA256
db69b5cfee1810c6a32962f3470b074ec6d65d66160bf34f39b258f947fd6a99

SHA512
9a0e4861182593f81cb1436572ebad3bb5fa9d8127bbe359c4777353b15e49f3c560bc72bc684f0a88efea9a83ca7cb2462af186e2bba59cc954cfc0000b190f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
25d4bdb9282af27b9a968c81fd094c51

SHA1
ddb67ebe7d1eb361bb2d5e2559266e41360470e9

SHA256
17fc5614c5a9839efead88e33ca18ec7c38fa60841e561648cddb8c592528ee0

SHA512
e99f6b3f11a8fb9d0c218b8ff3a79a5fab60ba62866e7c26e9ed6e115a06a03281c9ef6fe4a8a5d4e7c47aa0dde232dad94156135f6a0ef8d7fe2de85f304405

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
16c35a435b22ad7557dd7f9e653253aa

SHA1
dbc746a772ffbc830a6c070e15bd9ce749321085

SHA256
7702157687255af687a9c44a022f615d8868317b094e8e78eaa380c35dda29b3

SHA512
d5c557c04f8a32800ca570459f99addd4ad2e887674abcf0cab463cd6b2ccb14d18ad0553bfb8db8e4dfef5d15983bfb836dd9632165a442863f61faa81d374f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
16ac8175a8940e15f588a6899607fae5

SHA1
29cf604f6d51aa6f234f8e1457c8a412bf547bf2

SHA256
b1d5186ca5bca9e884d1ccde26b9a67a2e00a80854f6658bfd3dbd4ac90f1aca

SHA512
bcf1816430f163bb9f47cea97e95e9d59ded94ec438c474c1bd95e79afaf98ae7dd2a244f9cd919751f42cbf43198a8953634f102223ffdaff027564979f72f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
61625e08d46f701e176f01ac6019ba19

SHA1
a23a1a970054b95fa38fc681b34783e274e60636

SHA256
02e7bc0088f846134437f4009c5fc36bbede046616c33b37e3728513a0e1dfdb

SHA512
c7de69aef9bc8e4ae14cb402a9a2de0867071568f8160b2d625358bc08c6a9f318c2fd0553f7de6dcec03df749a6313048b8b2c41cb2e3eed5544937a57e8fff

Download Submit
C:\Users\Admin\AppData\Roaming\Oski Cracked.exe

Filesize
3.9MB

MD5
2bd0e61c45d352697c5e16437d8055b0

SHA1
0b9b24d396a50c2dc13d73e1f2d57c1891de3f31

SHA256
71efc8fc1dede4f96e837043ad3cbd38a65bd530ce71ae4d44ddc29843fab70b

SHA512
80044d4ece73637328e9b456c3127be02ecc9cea4b12fee65a884fed0266187aec58e6906c652face3b6125d59b9fa10303f02e1d8bfa33dbccb62fd2bc2b73d

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security.exe

Filesize
657KB

MD5
afdef9702262982ab384060d18d03b62

SHA1
118816cd69ca66a736fb12857e9566c491ec4c45

SHA256
e7a0e4fd18d08ffe77220d4fdc01598fb6b04f4cfdc8ee20875bd3b106f13be3

SHA512
e17f3a54e698546b9e07831dec8dbdc02cf925b282451825e0d9bb3fa8644e45a2405849f17ff0a9b60c0dc5d856420fce4de24edbade5b950a74b4ef4f8611a

Download Submit
C:\Users\Admin\Desktop\Oski_Cracked_107.180.3.147.exe

Filesize
200KB

MD5
a8c51927028432faaed3f6c3082417c1

SHA1
de2d018bf420b68ad5aa2fa1739d6d66cf12427e

SHA256
7130d400e99b00cb41f78765b021d213782bc079d149b54cce731081c6e5a8e4

SHA512
a45034788da5ea857cb4274c509b33f28956c9b9393b380450171b957b3df14fec11fed264e09ad518f1570ca5eeb6b21decd65e6df26c53349a272f1f2debd9

Download Submit
memory/988-155-0x0000000001100000-0x00000000011AA000-memory.dmp

Filesize
680KB

Download
memory/988-156-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/988-172-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/1028-1098-0x000000001B240000-0x000000001B2C0000-memory.dmp

Filesize
512KB

Download
memory/1028-1093-0x00000000001E0000-0x00000000005D6000-memory.dmp

Filesize
4.0MB

Download
memory/1028-1094-0x000007FEF42F0000-0x000007FEF4CDC000-memory.dmp

Filesize
9.9MB

Download
memory/1028-1095-0x0000000076D40000-0x0000000076E5F000-memory.dmp

Filesize
1.1MB

Download
memory/1028-1100-0x000000001B240000-0x000000001B2C0000-memory.dmp

Filesize
512KB

Download
memory/1028-1099-0x000000001B240000-0x000000001B2C0000-memory.dmp

Filesize
512KB

Download
memory/1028-1119-0x000007FEF42F0000-0x000007FEF4CDC000-memory.dmp

Filesize
9.9MB

Download
memory/1336-176-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/1336-163-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1336-1059-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/1336-174-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/1508-76-0x0000000002A50000-0x0000000002A90000-memory.dmp

Filesize
256KB

Download
memory/1508-75-0x000000006E6E0000-0x000000006EC8B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-80-0x000000006E6E0000-0x000000006EC8B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-77-0x0000000002A50000-0x0000000002A90000-memory.dmp

Filesize
256KB

Download
memory/1628-53-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/1628-54-0x00000000009F0000-0x0000000000A9A000-memory.dmp

Filesize
680KB

Download
memory/1628-67-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/1628-55-0x00000000049D0000-0x0000000004A10000-memory.dmp

Filesize
256KB

Download
memory/1664-1090-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/1664-1081-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/1664-1080-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/1992-1116-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/1992-1104-0x0000000000C50000-0x0000000000C90000-memory.dmp

Filesize
256KB

Download
memory/1992-1102-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/2012-152-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/2012-70-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/2012-69-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/2012-60-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2012-153-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/2148-1063-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/2148-1064-0x0000000000AB0000-0x0000000000AF0000-memory.dmp

Filesize
256KB

Download
memory/2148-1077-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/2152-171-0x000000001B300000-0x000000001B380000-memory.dmp

Filesize
512KB

Download
memory/2152-78-0x000000001B300000-0x000000001B380000-memory.dmp

Filesize
512KB

Download
memory/2152-616-0x0000000076D40000-0x0000000076E5F000-memory.dmp

Filesize
1.1MB

Download
memory/2152-175-0x000000001B300000-0x000000001B380000-memory.dmp

Filesize
512KB

Download
memory/2152-173-0x000000001B300000-0x000000001B380000-memory.dmp

Filesize
512KB

Download
memory/2152-19-0x00000000010B0000-0x00000000014A6000-memory.dmp

Filesize
4.0MB

Download
memory/2152-20-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download
memory/2152-84-0x000000001B300000-0x000000001B380000-memory.dmp

Filesize
512KB

Download
memory/2152-74-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download
memory/2152-73-0x000000001B4A0000-0x000000001B8BC000-memory.dmp

Filesize
4.1MB

Download
memory/2152-82-0x0000000076D40000-0x0000000076E5F000-memory.dmp

Filesize
1.1MB

Download
memory/2152-81-0x000000001B300000-0x000000001B380000-memory.dmp

Filesize
512KB

Download
memory/2152-617-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download
memory/2152-23-0x0000000076D40000-0x0000000076E5F000-memory.dmp

Filesize
1.1MB

Download
memory/2216-1120-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/2216-1121-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

Filesize
256KB

Download
memory/2432-31-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2432-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2432-40-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2432-43-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/2432-27-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2432-83-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/2432-29-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2432-44-0x00000000042E0000-0x0000000004320000-memory.dmp

Filesize
256KB

Download
memory/2432-33-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2432-37-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2432-42-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2432-151-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/2944-21-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download
memory/2944-45-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/2944-17-0x0000000000AE0000-0x0000000000B8A000-memory.dmp

Filesize
680KB

Download
memory/2944-18-0x00000000721C0000-0x00000000728AE000-memory.dmp

Filesize
6.9MB

Download
memory/2944-25-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/2944-22-0x0000000000380000-0x000000000038A000-memory.dmp

Filesize
40KB

Download
memory/2972-0-0x0000000074090000-0x000000007463B000-memory.dmp

Filesize
5.7MB

Download
memory/2972-3-0x0000000000B10000-0x0000000000B50000-memory.dmp

Filesize
256KB

Download
memory/2972-2-0x0000000074090000-0x000000007463B000-memory.dmp

Filesize
5.7MB

Download
memory/2972-16-0x0000000074090000-0x000000007463B000-memory.dmp

Filesize
5.7MB

Download